‘You have a meeting’: the calendar phishing scam growing exponentially

Calendar phishing scams are growing exponentially, with scammers using legitimate platforms and AI-backed blockers to evade detection.

The full report

Calendar phishing scams are a type of phishing attack that uses electronic calendars to lure victims into logging in to fake websites, according to The Guardian — Technology. The scam takes several forms, including a fake meeting, or a prompt to renew a service you pay for. An entry appears in the victim's electronic calendar after scammers send an email to their work or personal address with a calendar request.

The scam can be convincing, as calendar apps such as Google Calendar can add invitations automatically without users even accepting them, says Luke Wescott, a threat detection engineer at Sublime Security. This means scammers don't even need the victim to open an email. The entry in the calendar can create a borrowed credibility, making the victim more likely to trust the invitation.

Max Gannon, an intelligence analysis manager at the cybersecurity company Cofense, says some scammers are using legitimate platforms such as Zoom to send the invitations, making them look more convincing to the recipients and to security software. This makes it harder to block the scam, even for AI-backed blockers.

The titles of the fake invitations can vary, but examples seen by The Guardian include fake meetings, notifications of voicemail messages, and software renewals. Wescott says this is standard, and the invitations can be customised to look like they have come from within the company.

The Guardian — Technology reports that calendar phishing scams are growing exponentially, with Wescott saying that Sublime Security has seen 'exponential growth' in the number of attacks. Gannon adds that the scam is becoming increasingly sophisticated, with scammers using legitimate platforms and AI-backed blockers to evade detection.

Reporting status

This original NewNWS report was drafted from the cited source material and passed a second evidence check. Claims that remain the account of one publisher are attributed in the source disclosure below.