Calendar phishing reaches staff through auto-added invites even when the email lands in spam
Sublime Security says calendar phishing is growing exponentially as apps like Google Calendar add invites automatically, even from emails sent to spam. That moves the defence from the mail filter to calendar settings and to what staff do with an unexpected meeting.
The Board Room · Leadership desk
Staff: invites arrive even if the email lands in spam. Security teams: filtering out invitations from these platforms would also block legitimate ones. Work email: a stolen password can open it. Calendar users: can accept only known senders. Suspicious invite: delete or report, don't decline.
- Who's exposed exposure Staff A calendar request reaches them even if they miss the email or it ends up in the spam folder, claim 2
- What it limits constraint Security teams Filtering out invitations from these platforms would also block any legitimate meeting invitations, claim 8
- Who's exposed exposure Work email accounts A stolen name and password can be used to break into work email, claim 13
- What's now possible capability Calendar users Google Calendar settings can accept invites only from known senders or once the user has accepted, claim 15
- Who has to decide decision Staff with a suspicious invite Delete it or report it as spam; clicking decline can tell the sender the address is live, claim 16
| Who | How | Kind | Claim |
|---|---|---|---|
| Staff | A calendar request reaches them even if they miss the email or it ends up in the spam folder | exposure | 2 |
| Security teams | Filtering out invitations from these platforms would also block any legitimate meeting invitations | constraint | 8 |
| Work email accounts | A stolen name and password can be used to break into work email | exposure | 13 |
| Calendar users | Google Calendar settings can accept invites only from known senders or once the user has accepted | capability | 15 |
| Staff with a suspicious invite | Delete it or report it as spam; clicking decline can tell the sender the address is live | decision | 16 |
What happened
- Cofense's Max Gannon says some scammers send the invitations through legitimate platforms such as Zoom so they look convincing to recipients and to security software.
- Gannon says an invitation can be made to look internal, with customised content and the target company's logo added.
- Lure titles include new voicemail alerts, payment receipts, PayPal unusual-activity warnings, auto-payment notices and invitations to bid on a contract.
- The event description usually holds a link to a fake Microsoft, Google or PayPal login page, or a 'support' number to call about a charge that never happened.
- Recipients are not compromised until they click the link or make the call, and the scammers do not get access to everything on the calendar.
Why it matters
- What it limits constraint Security teams cannot close this route at the mail gateway without also stopping real meeting requests, so the control has to sit in calendar settings and staff behaviour.
- Who's exposed exposure One password typed into a fake login page can open a work mailbox, so a lure dressed as a personal reminder is a risk to company accounts.
- What it costs cost Because the technique is ordinary phishing, the training change is an addition to existing courses, with calendar entries and fake support numbers joining the examples staff already see.
Next story · Leadership · Oct 8
Asos widens its breach disclosure after hackers share a data sample with the BBCConfirmed2 publishers
The email that delivers a calendar phish can go unread. It can sit unopened or land in the spam folder, and the entry still appears on the calendar [2]. "Calendar apps, such as Google Calendar, can add invitations automatically without users even accepting them," Luke Wescott, a threat detection engineer at Sublime Security, told the Guardian. "So scammers don't even need you to open an email." [3]
Where the entry appears matters. Someone who would ignore an email from an unfamiliar name may treat the same request differently once it sits on their calendar, the Guardian reported [5]. "It can create a borrowed credibility by showing up in the same place as your dentist appointment or a weekly 1:1 with your boss," Wescott said [4].
The obvious response is a stricter mail filter. Max Gannon, an intelligence analysis manager at Cofense, said the scammers' use of real meeting platforms defeats it [6]. "That makes it really hard to block," he said. "Even AI-backed blockers struggle." [7] A rule aimed at those platforms "would also block any legitimate meeting invitations", Gannon said [8].
That leaves the calendar. Wescott advises turning off automatic acceptance, and Google Calendar lets users add invitations only from known senders or once they have accepted [15]. We think this is the change to make this quarter. It costs a settings review, and it closes the route that skips the spam folder. We'd expect the cost to show up next quarter, when invitations from unrecognised senders wait for a manual accept and staff who book meetings with new outside contacts notice the delay.
A skeptic would say this is ordinary phishing. Wescott largely agrees, saying "it sounds familiar to typical phishing, it's the same technique, just using a different delivery method" [12]. One habit still needs separate teaching, because instinct points the wrong way. "Don't click 'decline' on suspicious invites as it can tell the sender that your address is 'live'. Instead, delete or report it as spam/junk," Wescott said [16].
The stakes are those of any stolen password. Fraudsters can sell the details in batches, use them to break into work email, or use them to pose as a bank [13]. The evidence on scale is thinner. Sublime says the attack is still relatively new but that it has seen "exponential growth" [1]; the Guardian's report does not include a count or a rate. Both people quoted work at security companies [1][6].
What to watch
- Whether Google or Microsoft change calendar defaults so invitations from unknown senders no longer appear automatically.
- A published count from Sublime Security, Cofense or another firm that puts a number on the claimed exponential growth.
- Whether meeting platforms such as Zoom act against accounts used to send lure invitations.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence52
- Adoption
- Not scored
- Hype gap+20
- Incentives55
- Confidence62
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Luke Wescott, a threat detection engineer at Sublime Security, says calendar phishing is still relatively new but the company has seen "exponential growth".
- [2]
Calendar phishing entries arrive after scammers send an email with a calendar request to a work or personal address; it does not matter if the recipient misses the email or it ends up in the spam folder.
- [3]
"Calendar apps, such as Google Calendar, can add invitations automatically without users even accepting them," Wescott says. "So scammers don't even need you to open an email."
- [4]
"It can create a borrowed credibility by showing up in the same place as your dentist appointment or a weekly 1:1 with your boss," he says.
- [5]
While a recipient may not look twice at an email from someone whose name they do not recognise, they may treat something that turns up in their calendar differently.
- [6]
Max Gannon, an intelligence analysis manager at the cybersecurity company Cofense, says some scammers are using legitimate platforms such as Zoom to send the invitations, making them look more convincing to recipients and to security software.
- [7]
"That makes it really hard to block," he says. "Even AI-backed blockers struggle."
- [8]
If you set up something to filter out invitations from these platforms, Gannon says "that would also block any legitimate meeting invitations".
- [9]
Gannon says the invitation could look like it has come from within your company: "If they want to they could make it look like an internal invitation," he says. "They can customise the content, may be adding the logo of your company."
- [10]
The event description typically contains a link or a phone number. Wescott: "Either they want you to click a link to a fake login page like Microsoft, Google or PayPal, and enter your password, or to call a 'support' number to cancel a charge that never actually happened."
- [11]
Until the recipient clicks the link or makes the call, they are not compromised; the scammers do not have access to everything in the calendar and are trying to lure the recipient to hand over details.
- [12]
"it sounds familiar to typical phishing, it's the same technique, just using a different delivery method"
- [13]
Fraudsters who obtain a victim's name and password may sell it in a batch with other people's details, use it to break into work email, or use it to persuade the victim they are contacting them from a bank or another institution.
- [14]
Wescott says typical lure titles include 'New voicemail received', payment receipt confirmations, 'PayPal unusual activity' warnings, 'Your auto-payment will be processed within 24 hours', and invitations to bid on a contract.
- [15]
Wescott advises turning off automatic accepting; in Google Calendar users can go into settings and opt to only accept invitations from known senders, or when they have accepted.
- [16]
"Don't click 'decline' on suspicious invites as it can tell the sender that your address is 'live'. Instead, delete or report it as spam/junk."
Sources
2 independent publishers whose own reporting we read for this story.
- businessinsider.comThe annoying scam that may be hiding in your work calendar
1 article · October 12, 2026
- theguardian.com‘You have a meeting’: the calendar phishing scam growing exponentially
1 article · October 10, 2026
Topics and entities
Entities
- Microsoft
- Google Calendar
- Sublime Security
- Malwarebytes
- Okta
- Zoom