Calendar invites bypass spam filters as phishing surges 33,000%

A structural blind spot in how enterprise email platforms process scheduling data has turned calendar invitations into one of the fastest-growing delivery mechanisms for credential theft. Attackers are exploiting the iCalendar (ICS) file format to route malicious payloads directly onto employee schedules, sidestepping the spam filters designed to quarantine standard emails.

Incidents involving weaponized ICS files climbed roughly 33,000% between May and September, according to threat intelligence firm Sublime. The volume doubled or tripled monthly through June before accelerating past 1,000% growth in subsequent months.

The technique relies on a fundamental architecture split within productivity suites like Microsoft 365 and Google Workspace. When an attacker sends a crafted message containing both an email body and an embedded calendar attachment, the platform’s gateway evaluates them separately. A spam filter might flag and block the email text based on suspicious keywords or sender reputation. The attached .ics file often processes through a different pipeline entirely. If a user’s settings permit automatic event creation—a default configuration in many corporate environments—the fraudulent meeting lands directly on their calendar even while the accompanying email sits in a junk folder.

Threat actors populate these rogue events with fake payment invoices, urgent financial warnings, or QR codes. Clicking the embedded link redirects the target to counterfeit login portals mimicking services from Microsoft, PayPal, or other major vendors.

Cybercriminals have targeted scheduling protocols since at least 2019, when coordinated campaigns flooded Gmail users with fake event notifications. Defenses lagged because security vendors historically prioritized scanning executable attachments and hyperlinks in standard messages over parsing structured scheduling data. Antivirus engines frequently treat ICS files as benign text rather than potential attack vectors.

Executing an ICS campaign requires minimal infrastructure. Generating a valid calendar file costs nothing, making it significantly cheaper than deploying sophisticated exploit kits or purchasing access to compromised domains.

Responding to or declining a suspicious invitation can confirm to the sender that the targeted mailbox is active. Security researchers recommend deleting unrecognized events without interaction and routing them through internal spam reporting tools. Employees receiving unexpected calendar links from known colleagues should verify the request using a separate communication channel, such as a direct phone call or an internal messaging app.