A calendar notification drops into your day: an unpaid invoice, an account suspension warning, a refund requiring immediate action. The sender is unfamiliar, but the event sits right there on your calendar, formatted like every legitimate meeting you have ever accepted.
That’s the attack. According to Sublime, the security firm, ICS-phishing activity grew by roughly 33,000% between May and September 2026. Month-to-month increases reportedly reached 282% from May to June, 338% from June to July, and more than 1,000% in later periods. Those figures reflect Sublime’s own telemetry and detection data, not a universal count of all calendar phishing across the internet.
Why Your Calendar Is Now a Target
Attackers are exploiting the trust users place in calendar software, and your settings may be making it easier for them.
Calendar platforms can handle invitations differently from standard email content. A malicious event may land directly on your calendar even when a related email is flagged as spam.
Once it appears alongside your real meetings, it borrows their visual legitimacy. Think of it as the phishing equivalent of a fraudulent Venmo request appearing inside your banking app: the interface signals trust, and that signal does most of the work.
What a Suspicious Invite Looks Like
Reported campaigns follow recognizable patterns that are worth knowing before an invite catches you off guard.
These events typically arrive from unknown senders and carry urgent language about a payment, account suspension, overdue invoice, or refund deadline. That urgency is the mechanism; it is designed to make you act before you think.
The description may contain a link, QR code, or phone number directing you to “support” or “fraud prevention.” The destination often imitates a recognizable brand such as Google, Microsoft, PayPal, or a bank, though the domain will not match the impersonated organization on closer inspection. Any request for password vaults, payment-card numbers, one-time codes, or recovery information is a hard stop, regardless of how professional the event appears.
What to Do Right Now
The most important rule is also the simplest: do not interact with a suspicious event before you verify it.
Do not click any link, scan any QR code, open any attachment, or call any number listed in a suspicious event. Replying to decline the invitation may also signal to the sender that your account is active, so skip that step as well.
Delete the event and report it as spam or phishing using your calendar or email platform’s built-in controls. If the invite appears to come from a known contact but feels off, verify through a phone number already saved in your address book or a fresh message you compose independently. To stay safe, avoid interacting with any unverified contact methods listed in the event itself.
Adjusting Your Google Calendar and Outlook Settings
Both Google and Microsoft provide controls that can reduce your exposure to unsolicited calendar invitations.
Google Calendar’s “Add invitations to my calendar” setting can be changed to “Only if the sender is known.” Google defines that as contacts, people within your organization, or people you have previously interacted with.
A stricter option, documented on Google’s settings page, adds an event only after you reply to the invitation by email. Android users should also review which apps hold calendar permissions and remove access for anything that does not need it, per Google’s guidance.
For Microsoft 365 users, Microsoft support documentation recommends marking suspicious messages as junk or phishing and watching for mismatched domains and unexpected payment requests. Administrators should separately review anti-phishing protections, sender blocklists, and mail-flow rules.
If you already entered credentials, change your password through the service’s official website and enable multifactor authentication immediately. Notify your IT or security team as well. If you submitted payment information, contact your financial institution using an official number and monitor your account closely. A calendar entry is not proof that an invitation is legitimate. It only means someone sent it.
