Calendar Phishing Scams Surge: How Fraudsters Are Hijacking Your Meeting Invitations to Steal Credentials

A New Vector for Credential Theft Is Spreading Through Calendars

Traders, analysts, and professionals who manage dense schedules are now facing a deceptively simple threat. A routine glance at a Google or Microsoft calendar reveals an entry for a meeting that was never scheduled. Clicking the item produces a note about a project review, a pending renewal, or an urgent action item, complete with a link to "more details." Following that link lands the victim on a login page that mimics a trusted service, and typing a username and password hands the credentials directly to a fraud ring.

Luke Wescott, a threat detection engineer at Sublime Security, describes the tactic as still relatively new but notes that his firm has observed "exponential growth" in the volume of such attacks. The scam typically manifests as either a fabricated meeting invite or a prompt to renew a paid service, but in every case the end result is the same: a calendar entry that the victim sees and instinctively trusts.

How the Invitation Gets There Without You Clicking Anything

The delivery mechanism is what makes this variant more insidious than a standard phishing email. Scammers dispatch a calendar request to a victim's work or personal inbox. Critically, the email does not need to be opened, read, or even noticed. As Wescott explains, calendar applications such as Google Calendar are capable of adding invitations automatically, without the recipient ever confirming them. In other words, the malicious entry can appear on a screen even if the originating email sits unread in the spam folder.

This automatic-acceptance behavior gives the attack a layer of borrowed credibility. Wescott points out that once a suspicious item sits alongside a dentist appointment or a recurring weekly one-on-one with a manager, the recipient's brain treats it as equally legitimate. The context of the calendar—familiar, routine, trusted—does the social-engineering work that a flashy phishing email would have to do on its own.

The Bait: Fake Alerts, Voicemails, and Payment Notices

The titles of these calendar entries vary widely. The Guardian's reporting identified fake meetings, voicemail notifications, and software renewal prompts. Wescott lists a broader catalogue of lures his team has encountered, including entries labelled "New voicemail received," "Payment receipt confirmation – $298.99," "PayPal unusual activity" warnings, "Your auto-payment will be processed within 24 hours," and even invitations to bid on a contract.

Max Gannon, an intelligence analysis manager at the cybersecurity firm Cofense, adds that the invitations can be crafted to appear as if they originated from inside the victim's own organisation. "If they want to they could make it look like an internal invitation," he notes, explaining that scammers can customise the content and attach the recipient's company logo to heighten the sense of authenticity.

In every variant, the event description carries a call to action: either a hyperlink to a counterfeit login page (impersonating Microsoft, Google, or PayPal) or a telephone number presented as a "support" line to cancel a charge that never existed. Wescott stresses that the compromise does not occur at the moment the calendar entry appears. "Until you click on this, or make a call, you are not compromised," he says. The scammers are not browsing the full contents of the victim's schedule; they are waiting for the victim to volunteer credentials or speak to a social-engineering operator.

Why Conventional Defences Struggle to Catch It

A complicating factor, according to Gannon, is that some operators are routing invitations through legitimate collaboration platforms such as Zoom. Because the invitation genuinely originates from a recognised service, it passes through security tooling with far less friction than a raw email from an unknown sender. "That makes it really hard to block," Gannon says, adding that "even AI-backed blockers struggle" to distinguish a malicious Zoom-originated invite from a genuine one. Building a filter to reject invitations from those platforms would, he warns, also suppress every legitimate meeting request a professional needs to see.

Wescott frames the overall technique as functionally identical to classic email phishing. "It sounds familiar to typical phishing, it's the same technique, just using a different delivery method," he says. The novelty lies in the channel, not in the intent.

What Traders and Professionals Should Do Right Now

Security experts converge on a short set of practical steps for anyone who works with dense calendars and frequent client or counterparty communications:

• Treat every unexpected calendar entry the way you would treat an unsolicited email. Do not click any embedded link, do not dial any listed number, and do not enter credentials on the page that appears.
• Adopt a posture of suspicion regardless of the apparent sender. Gannon's top advice is blunt: "My number one advice is people just need to be paranoid. It doesn't matter if the invitation has come from someone two desks down, you've got to be suspicious of everything."
• Disable automatic acceptance of calendar invitations. In Google Calendar, for example, the settings panel allows users to restrict automatic acceptance to known senders or to invitations they have explicitly approved. Wescott recommends this configuration as a first line of defence.
• Do not click "Decline" on a suspicious invite. Wescott cautions that declining registers the address as active in the sender's system, confirming the account is in use. Instead, delete the entry outright or flag it as spam or junk so the platform can suppress future attempts from the same source.

For forex traders and other finance-sector professionals whose daily workflow depends on email, calendar, and cloud-based document tools, the calendar channel represents a quiet but escalating attack surface. The credential sets stolen through this method can be resold in bulk, used to breach a firm's internal email, or leveraged in follow-on impersonation scams targeting banks, brokers, and counterparties. The defensive cost—reviewing an unfamiliar calendar entry before acting—is low; the cost of a single mistyped password is not.