Cybercriminals are increasingly exploiting calendar invites to launch phishing attacks, taking advantage of default settings in popular email platforms. According to cybersecurity firm Sublime, these scams have surged in recent months due to their simplicity and effectiveness. The attacks often bypass security measures by embedding malicious links or QR codes in calendar events, which are automatically added to users' calendars without their consent.
John Gallagher, VP at Viakoo, explained that these attacks succeed because they leverage the inherent trust in calendar invites. Unlike emails, calendar events are rarely scrutinized, making them an ideal vector for malware delivery. A recent example highlighted by Sublime involved a Google Calendar invite that directed users to a malicious remote monitoring and management (RMM) payload, disguised as a financial credit note.
To protect against these attacks, experts recommend disabling automatic calendar invite additions and scrutinizing sender details. Shane Barney, Chief Information Security Officer at Keeper Security, advised users to delete suspicious invites directly and report them as spam. Additionally, users should avoid clicking on any links or responding to the invites, as doing so can confirm the validity of their email address to attackers.
For Gmail users, adjusting the 'Add invitations to my calendar' setting to 'Only if the sender is known' or 'When I respond to the invitation in email' can mitigate risks. Microsoft Outlook users can disable automatic processing of meeting requests in the Mail and Calendar settings. By taking these precautions, individuals and organizations can reduce their exposure to this growing threat.