Fake calendar invites drive surging Microsoft credential-phishing campaign against 40,000+ organizations
Check Point researchers report large-scale phishing campaigns that abuse fake calendar invitations to harvest Microsoft account credentials. Lures arrive either as a malicious .ics attachment or as a link, for example in a fake Microsoft Teams meeting invite, that appears to point to one destination but leads to a credential-harvesting page. A surge began on September 25, 2026, and a new detection layer has flagged more than 302,386 unique phishing emails sent to more than 40,000 organizations. Volume is accelerating and was still observed on October 15, 2026. The article gives no attribution to a named threat actor.
Detalhes técnicos
- The .ics files contain valid calendar data, so the attack abuses calendar features and user trust rather than exploiting a software vulnerability.
- Link-based variants disguise the real destination of a "Join" button; the landing page is built to capture Microsoft login credentials.
- Scale: more than 33,890 sender domains and more than 247,270 unique sender addresses, averaging more than 8,319 emails per active day.
- Growth: a few thousand emails a month in April, more than 118,000 in September, and more than 740,000 in the first two weeks of October. The peak day was October 8, with almost 200,000 emails.
- Check Point has seen similar campaigns abusing other trusted automated messages, such as fake voicemail notifications with malicious attachments.
Remediação
The article gives no explicit remediation steps. Defenders should treat unsolicited calendar invites with caution, check where links actually lead before clicking, and consider email security controls that inspect calendar attachments and links.
Linha do tempo
-
Fake calendar invites drive surging Microsoft credential-phishing campaign against 40,000+ organizations
ler a análise desta fonte ocultar
Check Point researchers report large-scale phishing campaigns that abuse fake calendar invitations to harvest Microsoft account credentials. Lures arrive either as a malicious .ics attachment or as a link, for example in a fake Microsoft Teams meeting invite, that appears to point to one destination but leads to a credential-harvesting page. A surge began on September 25, 2026, and a new detection layer has flagged more than 302,386 unique phishing emails sent to more than 40,000 organizations. Volume is accelerating and was still observed on October 15, 2026. The article gives no attribution to a named threat actor.
Technical Details
- The .ics files contain valid calendar data, so the attack abuses calendar features and user trust rather than exploiting a software vulnerability.
- Link-based variants disguise the real destination of a "Join" button; the landing page is built to capture Microsoft login credentials.
- Scale: more than 33,890 sender domains and more than 247,270 unique sender addresses, averaging more than 8,319 emails per active day.
- Growth: a few thousand emails a month in April, more than 118,000 in September, and more than 740,000 in the first two weeks of October. The peak day was October 8, with almost 200,000 emails.
- Check Point has seen similar campaigns abusing other trusted automated messages, such as fake voicemail notifications with malicious attachments.
Remediation
The article gives no explicit remediation steps. Defenders should treat unsolicited calendar invites with caution, check where links actually lead before clicking, and consider email security controls that inspect calendar attachments and links.