Scammers Are Using Calendar Invites To Trick You. Here's How

A suspicious email lands in your spam folder, but the calendar invitation attached to it doesn't. You might never see the original email, yet the scam is already on your calendar.

And these attacks are surging. Security researchers at Sublime Security reported a 1,216% increase in calendar-based attacks they observed in August 2026 compared to July. The surge continued into September, with more attacks recorded in the first two weeks than during all of August. Scammers are using these invitations to deliver phishing links, malicious QR codes, and even malware downloads.[1]

The technique is known as ICS phishing, and it can affect users of Google Calendar and Microsoft 365. Here's how it works and how you can protect yourself.

Thanks for subscribing!

Please check your email for your first message.

Never miss the privacy news that affects you.

Join thousands who get the latest security news, scams, and policy changes every week, right to their inbox.

Sign me up

By submitting this form you agree to receive emails from All About Cookies and to the privacy policy and terms.

What is ICS phishing

ICS phishing uses calendar invitations to deliver scams through meeting entries rather than relying on email alone. The name comes from the .ics file format commonly used to share calendar events.

Sublime Security identified ICS phishing as an emerging threat in its 2026 Email Threat Research Report. But the attacks have accelerated considerably since then. In the first half of September alone, Sublime observed 1,426% more calendar-based attacks than in all of August. The company projected a 2,852% increase for September overall, but it has not confirmed that estimate.

These attacks work because email and calendar systems operate differently. Google Workspace and Microsoft 365 can automatically add invitations to users' calendars. Depending on your settings, a malicious event may appear on your schedule even if the original email is flagged as spam or blocked by email security software.

Attackers also exploit trusted services like Google Calendar and Microsoft 365 to make their invitations look legitimate. That gives scammers another opportunity to reach you through malicious links, QR codes, or phone numbers embedded in what looks like a routine meeting request.

How fake calendar invites lead to phishing scams

Scammers use familiar meeting invitations, account warnings, and financial notices to make malicious calendar entries look legitimate. Sublime Security has documented several examples, including attacks that steal login credentials or trick people into downloading remote-access software.

Fake conference calls: In one example, attackers abused FreeConferenceCall.com to create legitimate-looking meeting invitations. The messages instructed recipients to ignore the service's real dial-in number and call a different number controlled by the scammers. The same instructions appeared in the calendar event, keeping the scam visible even if recipients deleted the email.

QR-code phishing: Another attack used a calendar invitation with an attached PDF containing a QR code. Scanning the code directed recipients to a phishing page impersonating DocuSign, where attackers attempted to steal login credentials.

Fake account warnings: Scammers also used calendar events to deliver urgent warnings about expiring domains. One attack included an HTML attachment that opened a fake Microsoft-themed page before directing victims to a fraudulent GoDaddy login form.

Malicious software downloads: In a September 2026 investigation, Sublime identified a Google Calendar invitation that used a fake financial notice to direct recipients to a website offering a supposed credit note. Instead, the site prompted visitors to download a ScreenConnect installer configured to give attackers remote access to their computers. ScreenConnect is a legitimate remote-access tool, but scammers can misuse it to take control of devices.

The common thread is that the calendar invitation makes the message harder to overlook. Even if the original email is blocked, the event may remain on your schedule, giving attackers another opportunity to convince you to click, scan, call, or download something.

How to protect yourself from calendar invite scams

Unexpected calendar invitations deserve the same scrutiny as suspicious emails. You don't need to interact with every event that appears on your schedule, especially if it asks you to sign in, call an unfamiliar number, or download a file.

1. Restrict automatic calendar invitations. In Google Calendar, open Settings, find Event settings, and select Add invitations to my calendar. Choose Only if the sender is known to limit invitations from unfamiliar accounts. If you use a workplace calendar, your administrator may also control these settings.
2. Verify unexpected meeting requests. Don't trust an invitation simply because it appears on your calendar. If it claims to come from a bank, business, or colleague, contact them through a phone number or website you already know. Avoid unfamiliar links, QR codes, attachments, and callback numbers included in the event.
3. Use a password manager as an extra safeguard. A password manager can help you spot suspicious login pages because its autofill feature generally matches saved credentials to specific websites. If your usual credentials don't appear, double-check the address before signing in. However, autofill isn't a guaranteed defense against phishing.
4. Act quickly if you've shared information. If you entered your password on a suspicious website, change it through the legitimate service and sign out of other sessions. Enable two-factor authentication if available. If you shared financial information, contact your bank or card issuer and review your accounts for unauthorized transactions. If you installed unfamiliar software, disconnect the affected device from the internet and seek help removing it.

The bottom line

A phishing email doesn't have to reach your inbox to put you at risk. Depending on your calendar settings, its invitation could still appear alongside legitimate meetings, complete with malicious links, attachments, or phone numbers.

The safest approach is to treat unexpected calendar events with the same caution as suspicious emails. Limit automatic invitations from unfamiliar senders, verify meeting requests before opening attachments, and never enter your login details through an unfamiliar link or QR code.

Combine Sophisticated Malware Protection With $1M in ID Theft Insurance

4.5

AllAboutCookies writers and editors score products based on a number of objective features as well as our expert editorial assessment. Our partners do not influence how we rate products.

Editorial Rating

Claim Deal

On Aura Antivirus's website

2026 Editors’ Choice

Best Antivirus With ID Theft Protection

Antivirus Software

Aura Antivirus

PROMOTION: Up to 53% Off

• Antivirus that passes our malware and drive-by download tests, with fast scans and minimal impact on system performance
• Bundles with a VPN and safe browsing tools on every plan, no add-ons required
• Available with Aura identity theft protection plans if you want device security and ID monitoring in one subscription

Author Details

Krishi Chowdhary

About the Author

Krishi Chowdhary specializes in digital privacy, cybersecurity, and consumer technology. He has written extensively on online privacy tools and broader cybersecurity topics, including online scams, data breaches, age verification, and emerging digital threats. Krishi believes technology reporting should empower readers, not confuse them, and is committed to making even the most technical subjects easy to understand without compromising on accuracy or depth. His work has appeared in leading technology publications, including CNET, ExpressVPN, and TechRadar, where he has covered topics ranging from cybersecurity incidents and privacy product announcements to artificial intelligence and major technology news