Calendar Invite Phishing: How to Spot and Stop It in 2026

What is calendar invite phishing

The mechanics are simpler than they sound. An attacker sends an email with an attached .ics (iCalendar) file — a plain text format, structurally no different from a .txt file, just with fields for a title, time, description, and location. Most mail providers and clients, including Gmail, Outlook, and Apple Mail, parse .ics attachments automatically and create a calendar entry for the recipient without requiring any click. From there, ordinary reminder logic takes over: at the scheduled time, a pop-up appears on the phone or desktop with a "join meeting" or "view details" link.

The scale of this changed sharply in 2026. According to Check Point, the volume of malicious calendar-invite emails rose from a few thousand per month in April to more than 118,000 in September, and over 740,000 in just the first two weeks of October. Sublime Security separately recorded a 1,216% month-over-month increase in this attack type in August 2026 — this isn't a handful of isolated incidents, it's a sustained campaign hitting both corporate and personal inboxes.

This channel works precisely because a calendar feels like a trusted, personal space rather than an inbox you're already primed to scrutinize. The reminder pop-up arrives at exactly the "right" moment — right before a workday starts, ten minutes ahead of a scheduled call — so people react to it faster and with less skepticism than they would to an email from an unfamiliar address sitting in a promotions folder.

Why your spam filter doesn't stop this

The defining feature of calendar invite phishing is that mail filtering and calendar processing are, functionally, two separate pipelines handling the same message. A spam filter can correctly flag an incoming email and quarantine it — but the .ics attachment handler often fires before or independently of that spam verdict, and the event still lands in the recipient's calendar. In effect, the user never saw the original email, but already received its payload in the form of a scheduled event.

Sublime Security describes this exact failure mode directly: a malicious invite can remain on a victim's calendar even after the originating email has been correctly flagged and quarantined as spam. Rapid7 Labs researchers call auto-adding "the invisible click" — the user clicked nothing and opened no attachment by hand, yet the action (creating the event) still happened on their behalf.

There's a second variant that's harder to filter on the technical side: the invite comes from a genuine but compromised account belonging to a coworker, vendor, or contact. The sending domain is legitimate, the sender's reputation is clean, and the spam system has no reason to flag it — yet the event content still leads to a phishing resource.

What a fake invite looks like — the warning signs

• The organizer is unknown to you, or uses a free consumer email address rather than one you've corresponded with before.
• The title or description manufactures urgency: "access expires in 15 minutes," "confirm your account today," "meeting starting now."
• The event is framed around money — an invoice, a refund, a prize notification — which is unusual for a routine work or personal calendar.
• The meeting link sits inside the plain-text description or the location field instead of a proper conferencing integration — legitimate Google Meet, Zoom, and Teams invites generate that link automatically, not as hand-typed text.
• A QR code appears in the description instead of a normal link — the same trick used in quishing scams, covered in detail in our QR code phishing guide, just relocated into a calendar.
• The organizer is labeled as a "security team," a bank, or a major retailer — organizations like that don't send personal calendar invitations.

Where the links in fake events actually lead

The end goal is almost always one of three things. First, a fake login page visually cloned from Microsoft 365 or Google Workspace, with a form that harvests your username, password, and sometimes a two-factor code "to verify your identity." Second, a spoofed Zoom or Teams meeting page that, instead of connecting a call, prompts you to download a "player update" or "codec" — which installs an infostealer, malware designed to pull saved passwords and browser cookies (the mechanics are covered in our infostealer explainer). Third, the chain can connect to a ClickFix-style lure: a fake CAPTCHA or "security check" that tricks the victim into manually running a malicious command, detailed in our fake CAPTCHA / ClickFix breakdown.

How to turn off automatic invite adding

Google Calendar in a browser (Chrome, Windows)

Open calendar.google.com, click the gear icon, and choose "Settings." Under "Event settings," find "Add invitations to my calendar" — by default it's set to "From everyone." Change it to "Only if the sender is known" (meaning people in your contacts, your organization, or anyone you've already corresponded with) or the stricter "When I respond to the invitation in email." Once changed, invites from unfamiliar senders stop auto-creating events — they stay as plain emails until you decide to accept them yourself.

Google Calendar on Android

This setting lives on your Google account, not on a specific device, so it's simplest and most reliable to change it once in the web version — the change syncs automatically to your phone and the Calendar app. If a suspicious event has already shown up on your phone, don't tap any links inside it; just delete the entry the same way you'd remove any unwanted event.

Outlook and Microsoft 365

In classic Outlook, you can restrict automatic processing of meeting invitations and their automatic responses from within the mail settings related to invite tracking — the exact label varies by client version. Microsoft 365 users in a company environment should also check with their admin whether organization-level filtering of .ics attachments from external senders is already configured; that stops a lot of this before it ever reaches an individual inbox.

Calendar on Windows and other devices

A separate risk comes from subscribed external calendars (subscribed .ics feeds) added to the Windows Calendar app or other software at some point in the past. If you don't remember why you subscribed to a particular calendar, or don't recognize its name, open the subscription list in your app's settings and remove anything unfamiliar — a stale subscription like that can keep feeding in new fake events without a single new invitation email ever arriving.

What to do if a fake event is already on your calendar

The safest move is to simply delete the suspicious event rather than clicking "Decline" and sending a reply to the organizer: any response confirms to the sender that your address is live and actively monitored, so in borderline cases it's cleaner to just erase the entry without feedback. If your mail client offers a "report as spam" option on the originating email, use it — that helps filters catch similar campaigns faster for everyone.

If the sender has somehow ended up in your contacts (this can happen automatically after an exchange), go to contacts.google.com, find them under "Other contacts," and remove them — that lowers the odds their next invite gets auto-classified as coming from a "known sender."

If you already clicked through and typed a password into a suspicious page, act first and evaluate later. Change the password on the affected account, review the list of active sessions and connected devices and sign out of anything unfamiliar, turn on two-factor authentication if it wasn't already enabled, and ideally replace the password with a passkey, which can't physically be typed into a phishing page because it's never transmitted as text.

Does a VPN protect against calendar invite phishing

Honestly, not directly. A VPN encrypts the traffic between your device and its server, hides your real IP address, and secures your connection on open networks like a coffee shop or airport Wi-Fi, where someone else on the same network could otherwise intercept unencrypted traffic. But a VPN doesn't inspect the contents of your calendar, doesn't verify whether a meeting link is genuine, and can't physically stop you from typing a password into a fake login page — those are two separate layers of protection (see our full breakdown of what a VPN protects against, and what it doesn't).

Where a VPN does add practical value here is securing the connection itself when you open mail or calendar apps over public Wi-Fi: LiMP VPN for Chrome encrypts your traffic right inside the browser, adding a network-level layer of protection around the everyday actions you're already taking. It just doesn't replace the habit of checking the sender and locking down your invite-add settings — those are different problems entirely.

Checklist: protecting your calendar from phishing

• Change your invite auto-add setting to "Only if the sender is known" or stricter.
• Don't click links inside events you weren't expecting or didn't create yourself.
• Open conferencing tools and account dashboards manually, from a bookmark or search, never from a link inside an invite.
• Turn on two-factor authentication for your mail account, and move to a passkey where it's available.
• Review your subscribed external calendars and remove any feed you don't recognize.
• Check the "Other contacts" section of your mail account and remove unknown senders that landed there automatically.
• Never scan a QR code embedded in a calendar event from an unknown source.
• Tell coworkers and family about this scheme — calendar invite phishing works precisely because most people haven't heard of it yet.