SECURITY NOTICE: Calendar Phishing - A New Way Hackers Try to Trick You
What Is Calendar Phishing?
Phishing isn’t just about emails anymore. Hackers have found a new way to reach you—through your calendar. This scam, called calendar phishing or ICS phishing, uses unsolicited or malicious calendar invites to sneak in dangerous links or attachments. Because these invites look normal and often show up automatically, they’re easy to fall for.
Calendar phishing happens when attackers send fake meeting invites or .ics files that get added to your calendar. Many platforms, like Google Calendar and Microsoft 365, automatically add events without asking you first. That makes these scams look legitimate and hard to spot.
How Hackers Do It
- They send an email with a calendar invite or .ics file.
- Your calendar adds the event automatically.
- The invite includes a fake meeting link or malicious attachment (like an HTML file or a PDF with a QR code).
- Common tricks include:
- “Account Suspended” alerts in Outlook invites.
- Google Calendar events claiming you’ve won a prize.
- QR codes that lead to fake login pages.
Why It’s Dangerous
Clicking these links or opening attachments can:
- Steal your login details.
- Install malware on your computer.
- Give hackers access to company accounts. Even declining the invite can confirm your email is active, making you a bigger target.
How to Stay Safe
- Check the sender: Don’t trust invites from people you don’t know.
- Turn off auto-add:
- In Google Calendar: Go to Settings → Event Settings → choose “No, only show invitations to which I have responded.”
- In Microsoft 365: Ask IT to disable automatic processing.
- Review your calendar settings: Make sure events need your approval.
- Don’t click unknown links or attachments: Treat calendar invites like suspicious emails.
- Use security tools: Some email security systems can remove bad calendar events.
- Enable MFA (Multi-Factor Authentication): Adds extra protection for your accounts.
- Stay informed: Learn the signs of calendar phishing and share tips with your team.
Bottom Line: If an invite looks odd or urgent, pause before you click. A few quick checks can keep your calendar—and your company—safe.









