Fake Calendar Invites Used to Steal Email Credentials
A phishing campaign targeting 40,000 organizations uses fake meeting requests to trick users into revealing credentials.
Updated on Oct. 24, 2026 in Cybersecurity
Live Poll
Do you feel confident in your ability to spot a fake calendar invite at work?
Attackers are utilizing fake calendar invitations to harvest email credentials from targets across the globe. Researchers have identified more than 302,000 such phishing emails aimed at over 40,000 organizations.
Why it matters
The campaign demonstrates how attackers bypass traditional security filters by mimicking standard professional scheduling workflows. This technique leverages the inherent trust users place in legitimate calendar-based meeting requests to extract sensitive account access.
Researchers identified a phishing operation consisting of 302,000 malicious emails targeting 40,000 organizations. The scale of this campaign exceeds typical targeted phishing volumes, though the specific delivery infrastructure remains under investigation.
The details
The attack functions by sending phishing emails disguised as calendar meeting invitations. These messages contain links or attachments that prompt the recipient to sign into a fraudulent portal, thereby capturing their email credentials. By masquerading as standard scheduling requests, the phishing attempts exploit the routine workflows of employees who often engage with digital meeting invites without rigorous verification.
Timeline
October 2026: Researchers identified the phishing campaigns targeting organizations.
The Tech Race
This campaign follows the established trend of social engineering-based credential harvesting by evolving the delivery mechanism to mimic calendar-based scheduling. It highlights an ongoing shift where attackers move away from generic spam toward highly specific, workflow-integrated phishing tactics.
Organizations and individual users should treat unexpected calendar invitations, especially those requiring a sign-in to view details, with extreme caution. Verifying the sender and the meeting origin through secondary channels remains the most effective defense against this credential-harvesting method.
The takeaway
Attackers continue to weaponize professional productivity tools to bypass organizational defenses. Security teams should monitor internal traffic for suspicious calendar invites and enforce multi-factor authentication to mitigate the impact of compromised credentials.
Further reading
For more on the current state of digital threats, explore the latest trends in Cybersecurity.
Source note: This article includes information reported by ABC7 Chicago.
Live Poll
Do you feel confident in your ability to spot a fake calendar invite at work?
