Calendar Phishing Is on the Rise: Why Your Schedule Has Become a New Attack Surface

For years, security awareness training taught employees to be wary of suspicious emails. But attackers have adapted. Instead of relying solely on the inbox, they are increasingly targeting a place many people instinctively trust, the work calendar.

Calendar phishing is designed to steal credentials, trigger fraudulent payments, or lure users into calling fake support numbers. It is becoming a serious enterprise threat. In the past six months alone, calendar-invite phishing rose 49%, according to KnowBe4 threat research.

Why attackers are moving to the calendar

Calendar invitations work because they exploit both technology and human behavior.

A corporate calendar is a trusted operational tool. Employees use it to organize their workday, join meetings, manage deadlines, and communicate with colleagues, customers, and partners. Unlike an overflowing inbox, a calendar alert feels structured, system-generated, and urgent. When a reminder appears minutes before an apparent meeting, people are primed to act, not investigate.

Attackers take advantage of that “default-to-trust” mindset. A fake invitation may look like a routine Microsoft Teams meeting, a Google Calendar event, an HR update, a payroll discussion, a document review, or an urgent IT support session. The event can remain on a victim’s calendar and trigger follow-up reminders, giving the attacker more than one chance to prompt a click.

This makes calendar phishing a double-vector attack. The invitation may arrive by email, then reappear as a persistent event or notification in the calendar.

What a calendar phishing attack looks like

Most calendar phishing campaigns are built around a familiar looking event with a malicious next step. Common tactics include:

• A malicious link: The invite asks the recipient to “view meeting details,” “join now,” “review a document,” or “confirm attendance.” The link leads to a counterfeit login page designed to capture credentials.
• A phone number lure: The event asks the target to call “Microsoft support,” “IT help desk,” or a billing number. The scammer then attempts to extract credentials, MFA codes, payment information, or remote access.
• A fake urgent request: Attackers use words such as “deadline,” “action required,” “account suspended,” or “salary review” to pressure people into acting quickly.
• Brand or executive impersonation: The invitation may appear to come from Microsoft, Google, HR, finance, IT, a trusted vendor, or a senior leader.
• A fake login page: Even when an invite appears to come from the Outlook Calendar, its link may redirect to a fake Microsoft 365 sign-in page to steal corporate credentials.

What users should look out for

Employees should treat unexpected calendar invites with the same scrutiny as suspicious emails. Key warning signs include:

1. You do not recognize the organizer

Check the actual sender address, not just the display name. Attackers often use domains that are slightly different from the real brand or company, such as substituted characters, extra words, or unrelated domains.

2. The event creates urgency or fear

Be cautious of invitations mentioning account suspension, payroll issues, policy deadlines, unusual sign-in activity, urgent document reviews, or time-sensitive actions.

3. The invite asks you to sign in through a link

Do not enter credentials after following a link from an unexpected meeting invitation. Instead, open the service directly through a saved bookmark or the official app, then check whether the request is real.

4. The meeting contains a phone number for “support”

Legitimate IT teams rarely ask employees to call an unfamiliar number from a calendar event. Treat unsolicited support numbers as suspicious, especially if the caller requests a password, MFA code, screen sharing, software installation, or remote access.

5. The link destination does not match the claimed service

Hover over links where possible. A Microsoft or Google branded invitation should not send you to an unrelated or misspelled domain. Be especially wary of multiple redirects.

6. The invitation is irrelevant or unexpected

A meeting request about a service you do not use, a payroll process you did not initiate, or a project you are not involved with deserves verification through a known channel.

What organizations can do

User vigilance matters, but organizations should not place the entire burden on employees. Security teams should:

• Inspect calendar invites and .ics files as potential phishing vectors.
• Configure mail and calendar settings to limit automatic addition of external invitations where appropriate.
• Train users to verify unexpected meeting invites independently.
• Make phishing reporting simple from both email and calendar views.
• Use phishing resistant MFA, such as FIDO2 security keys or passkeys, to reduce the impact of stolen credentials.
• Monitor for lookalike domains, suspicious redirects, and fake Microsoft or Google login pages.
• Establish clear internal guidance. IT will not ask employees for passwords, MFA codes, or remote access through an unsolicited calendar invitation.

The bottom line

Calendar phishing is rising because it turns a trusted workplace tool into a shortcut around both technical controls and human caution. The 49% six-month increase should be a signal to treat the calendar as part of the organization’s phishing attack surface.

The safest habit is straightforward. An unexpected invite is not automatically a legitimate meeting. Verify the organizer, avoid links and phone numbers in suspicious events, and report anything that feels out of context before accepting, joining, or signing in.