iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Some Microsoft calendar invitations arriving in October 2026 are credential-phishing lures, not genuine meetings. Attackers attach valid-looking .ics files or add fake Teams “Join” links that open credential-harvesting pages. Because Outlook can turn the invitation into a calendar event, deleting the email alone may leave the malicious event, reminders and links behind.
What happened
Check Point Email Researchers reported on October 15, 2026, that a large campaign is abusing calendar invitations and Microsoft-themed meeting lures to steal credentials. Activity increased from September 25. Check Point’s detection layer recorded 302,386 unique phishing emails sent to more than 40,000 organizations and more than 740,000 emails during the first two weeks of October. October 8 was the busiest day, with almost 200,000 messages.
The messages use malicious .ics attachments, fake Microsoft Teams meeting links, or both. A visible “Join” button can lead to a counterfeit sign-in page instead of Teams. Check Point says the campaign abuses trusted calendar workflows and user expectations rather than exploiting a software vulnerability.
“We have identified several large-scale phishing campaigns that abuse fake calendar invites to harvest credentials,” Check Point Email Researchers said.
#1 Best Overall
Yubico - YubiKey 5C NFC - Multi-Factor authentication (MFA) Security Key and passkey, Connect via USB-C or NFC, FIDO Certified - Protect Your Online Accounts
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What the invitation may contain
The subject and event body are written to make an immediate response seem routine or urgent. Examples reported by Fortra’s FIRE team include a Microsoft 365 administrative alert, a domain-renewal warning and an invoice-signature request. The event can carry an HTML attachment or an embedded link that continues the phishing flow.
How the calendar attack works
- Delivery: The attacker sends an email with an iCalendar (
.ics) attachment or a meeting link that appears to belong to Microsoft Teams. - Calendar creation: Outlook parses the invitation and creates a tentative event. The calendar object can include links, HTML content and reminders even if the original message receives little attention.
- Trust transfer: The event presents an administrative or billing emergency and may use Cloudflare-style checks, DocuSign branding or registrar branding to look familiar.
- Authentication lure: A legitimate-looking Microsoft sign-in prompt asks the recipient to continue, approve access or enter credentials.
- Token or credential theft: In a related “CalPhishing” chain, Fortra describes ConsentFix, also called device-code phishing. Completing the flow can give the attacker the authentication token needed to access the account, subject to the organization’s tenant and device restrictions.
Microsoft Learn warns that attackers can nest attachments—for example, an email containing a calendar invitation—to create a multistage phishing flow. Entering credentials on the resulting site gives the attacker account information.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Why deleting the email may not remove the threat
A calendar invitation is a separate Outlook object after it has been processed. Fortra reports that moving the message to Junk or using a soft delete can leave the meeting entry, reminders and malicious content in the calendar. A hard deletion of the event may be required.
Recommended Free Tools
That persistence explains why a user can still see a suspicious meeting after the related email has disappeared from the inbox. The event itself must be inspected and removed; cleaning only the message does not reliably clean the calendar.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What to do when an unexpected invite arrives
- Do not use the event’s Join, document or sign-in link. Treat an unsolicited invitation that requests authentication, payment, renewal or signature as untrusted.
- Inspect the calendar item. Look for external URLs, HTML attachments, unfamiliar organizers and administrative or billing language. A valid-looking
.icsstructure does not prove that the sender or destination is legitimate. - Verify independently. Contact the supposed organizer or your IT team through a known phone number, existing chat, or a newly opened browser session—not through contact details in the invitation.
- Remove both artifacts. Delete the calendar event and then report or delete the original message according to your organization’s process. If the event remains, ask an administrator to perform the hard deletion.
- Assume exposure if you entered credentials or approved a code. Notify your security team immediately so they can revoke sessions, reset credentials and check the account for unauthorized activity.
How organizations can block calendar-invite phishing
No single control covers every stage. The following measures address different points in the chain.
| Control | What it should inspect or enforce | Important limitation or operational note |
|---|---|---|
| Calendar and ICS inspection | Scan .ics files and created events for external URLs, HTML attachments, embedded links and unusual administrative or billing subjects. |
Email-only inspection can miss content that Outlook renders in the calendar after delivery. |
| Calendar-event cleanup | Find and remove malicious meetings, reminders and attachments as well as the originating email. | Soft delete or moving a message to Junk may leave the event in place; hard deletion can be necessary. |
| Conditional Access | Restrict device-code and other risky authentication flows, with exceptions limited to reviewed users or groups. | Policies must account for legitimate workflows and for tenant and device restrictions that affect token use. |
| Phishing-resistant MFA | Require phishing-resistant authentication for administrators and other high-value accounts. FIDO2 security keys are one hardware-based option when they are compatible with the tenant and devices. | MFA strength matters: a user who supplies a token or approves a malicious device-code flow may still expose a session. |
| User verification and reporting | Teach staff to verify unexpected invitations through a separate channel and inspect the true destination of Join and document links. | Training complements technical controls; calendar objects often receive less scrutiny than normal email. |
Will MFA stop a fake Teams or Outlook invite attack?
MFA is an essential identity-security control and Microsoft says it is highly effective against device-code phishing when implemented in a phishing-resistant form. It is not a guarantee that every MFA method will stop this campaign. If a user types a password into a counterfeit page or completes a device-code sequence, an attacker may obtain a session token rather than simply guessing the password. Conditional-Access restrictions, phishing-resistant MFA and rapid session revocation therefore work together.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How to judge whether an invite is real
- The meeting was unexpected or the organizer is unknown.
- The event asks for a password, code approval, payment, renewal or signature.
- The Join or document destination is external, misspelled, shortened or different from the service named in the message.
- The invitation includes an HTML attachment or multiple nested files.
- The event creates urgency that is out of proportion to an ordinary meeting.
A genuine calendar file can still contain external links, so the presence of an .ics extension is not itself proof of fraud or authenticity. Verify the organizer and destination independently before signing in.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Quick Recap
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
