Phishing
Fake calendar invites phish Microsoft logins at scale
Check Point counted 302,386 fake meeting invites sent to 40,000+ organizations to steal Microsoft passwords. How the lure works and what to set in Microsoft 365.
Check Point's email research team reports a fast-growing wave of fake calendar invitations built to steal Microsoft account passwords. Since a surge that began on September 25, 2026, a new Check Point detection layer has flagged 302,386 unique phishing emails sent to more than 40,000 organizations. The invites look like routine meeting requests or Microsoft Teams meetings, and every route ends on a fake Microsoft sign-in page.
If your staff use Microsoft 365 and accept meetings from outside the company, you are in the target group. Nothing here exploits a bug in Outlook, Teams or the calendar format, so there is no patch coming. The defences are configuration, sign-in policy and a quick check of who has already clicked.
How the lure works
A meeting invitation is two things at once: an email, and an event. When an invitation reaches an Exchange Online mailbox, a background process called the Calendar Attendant reads it and, by default, places the meeting on the recipient's calendar as tentative before anyone opens the message. Microsoft's own notice MC1151684 describes the consequence: the calendar entry created at delivery stays active and visible even after the email is removed.
Check Point saw two variants. In the first, the email carries an .ics attachment, the standard iCalendar file every calendar app uses to describe a meeting. Check Point describes the file as valid calendar data that abuses the format, so attachment filters looking for malware have nothing to catch. From the invite, the recipient is steered to the fake sign-in page; the reports do not say exactly where in the invite the link sits.
In the second variant there is no attachment. The email imitates a Teams meeting invite, and the "Join" button or link text shows a Microsoft or Teams address while the real target is elsewhere. Hovering over the link reveals the true destination, which is a credential-harvesting page dressed as a Microsoft login.
The reports describe pages that record the username and password. They do not say whether the pages also relay a multi-factor authentication (MFA) prompt in real time, the technique known as attacker-in-the-middle. Treat that as unknown, and assume a captured password plus an approved push notification or SMS code is enough to take over an account.
Calendar lures work for a reason Help Net Security spells out: email and calendar travel different paths, so a message can be quarantined while its meeting still sits in the calendar. A confused user who sees an unfamiliar meeting is likely to click it just to check whether they forgot something.
What attackers are doing
Check Point puts the scale this way. The 302,386 unique emails since September 25 came from more than 33,890 sender domains and more than 247,270 sender addresses, at an average of more than 8,319 emails per active day. With that many senders, blocking individual addresses or domains will not keep up. Activity was still running on October 15.
Check Point also tracks the monthly trend. Volume grew from a few thousand emails a month in April to more than 118,000 in September, then to more than 740,000 in just the first two weeks of October. The busiest day was October 8, with almost 200,000 emails. Hackread, reporting on the same research, notes that the 740,000 figure is a separate measurement from the 302,386 unique emails flagged by the newer detection layer, so the two numbers should not be added or compared directly.
None of the figures count breached accounts. They count messages that reached organizations, and no source has published how many people entered their passwords.
What to do
1. Make a stolen password insufficient
In the Microsoft Entra admin center, create or edit a Conditional Access policy for all users, and under Grant choose "Require authentication strength" with the built-in "Phishing-resistant MFA" strength. That accepts passkeys (FIDO2), Windows Hello for Business and certificate-based authentication. Start with administrators and finance staff if a full rollout takes time. These methods are bound to the real Microsoft domain, so a fake page cannot collect or replay them.
2. Use Defender's calendar cleanup
Since September 2025, the Hard Delete action in Microsoft Defender for Office 365 (in Explorer, Advanced Hunting and the API) also deletes the calendar entry created by a malicious invite email. It is on by default. It does not remove entries a user added by hand from an .ics attachment, so check those separately.
3. Decide how to handle external .ics files
In the Exchange admin center, under Mail flow, then Rules, a rule with the conditions "The sender is external/internal: Outside the organization" and "Any attachment, then file extension includes these words: ics" can quarantine these messages or add a warning to the subject. Rules like this also catch genuine invites from partners, so add exceptions for trusted sender domains and test before enforcing. For a small set of high-risk mailboxes, Set-CalendarProcessing -Identity <mailbox> -AutomateProcessing None turns off the Calendar Attendant so invites no longer appear on the calendar by themselves; users then have to accept every real meeting manually.
4. Keep Safe Links strict
In your Safe Links policy, leave "Let users click through to the original URL" turned off, so a link that Defender judges malicious at click time stays blocked.
5. Hunt for recipients and clicks
In Defender Advanced Hunting, list inbound .ics attachments since the surge began, and review the senders you do not recognise:
EmailAttachmentInfo
| where Timestamp > datetime(2026-09-25)
| where FileName endswith ".ics"
| join kind=inner (EmailEvents | where EmailDirection == "Inbound") on NetworkMessageId
| project Timestamp, SenderFromAddress, RecipientEmailAddress, Subject, FileName
The UrlClickEvents table shows who clicked links in email. For anyone who did, open their Entra sign-in logs and look for successful sign-ins from IP addresses, countries or devices they have not used before.
6. Clean up any account that signed in
Reset the password, then revoke existing sessions with Revoke-MgUserSignInSession in Microsoft Graph PowerShell, since a reset alone does not end sessions already issued. Run Get-InboxRule -Mailbox <user> and remove rules that forward, redirect, delete or move mail you did not set up, and check the mailbox for forwarding addresses. Review the account's registered MFA methods and devices for anything the attacker added to keep access.
7. Give staff one habit
Do not join a meeting or sign in from an invite you did not expect. Open Teams or Outlook directly and find the meeting there, and if it is not there, report the invite.
Why this keeps working
Calendar invites borrow trust from the tools that display them. They show up in Outlook, look like Teams and land on the calendar without a click, so the cues users are trained to spot are weaker. A phishing runbook that only quarantines or deletes the email can leave the meeting behind, as Microsoft's own notice shows. Add the calendar entry to that runbook and confirm your tooling removes it.
Calendar and sign-in policy reviews are part of our safeguarding and hardening work, and our security operations team hunts for this kind of account takeover. If you want to know how your tenant would handle a fake invite today, open the chat and Yaali, our AI agent, will pass your question to an engineer.
Sources: Check Point, TechRadar, Truesec, Help Net Security, Hackread, Microsoft Learn: Set-CalendarProcessing, Microsoft 365 message center MC1151684, Help Net Security on Defender calendar remediation, Hoxhunt, Microsoft Learn: EmailAttachmentInfo.