By Hamza Faisal
That routine calendar invite sitting in your inbox might not be a meeting at all. Security researchers at Check Point have exposed a large-scale phishing campaign that uses fake calendar invitations — including bogus Microsoft Teams invites — to steal Microsoft account credentials from businesses around the world.
Check Point Research says a detection layer built specifically to spot this attack has flagged more than 302,386 unique phishing emails sent to over 40,000 organizations. The messages came from 247,270 unique sender addresses across 33,890 different domains — a footprint that shows this is no small-time operation with disposable accounts, but a sprawling, well-resourced campaign.
The meeting invite that isn't one
The attackers take two approaches, both designed to look like an ordinary part of the workday. Some emails arrive with an .ics attachment — the standard calendar file format. Because the file holds valid calendar data rather than exploiting any software flaw, it can sail through email filters and even drop the fake meeting straight onto the victim's calendar, keeping the lure visible long after the email is forgotten.
The second approach is a fake Teams meeting invite. The "Join" button looks like it leads to a Microsoft login, but hovering reveals the truth: the real destination is a credential-harvesting page designed to capture the username and password typed into it.
Activity is accelerating, not fading
Check Point's email researchers say the surge began on September 25, 2026, and the numbers show it only getting louder. Daily volume climbed from a few thousand emails a month in April to more than 118,000 in September — and then past 740,000 in just the first two weeks of October. The busiest single day so far was October 8, with nearly 200,000 messages, averaging more than 8,319 emails per active day.
The researchers stress that these figures describe observed phishing activity, not confirmed account takeovers. But the direction of travel is unmistakable: calendar-based social engineering is becoming a mainstream channel for credential theft.
What teams should do now
The campaign's real weapon is not code but routine. Meeting invites land in inboxes constantly and are almost never questioned — exactly what the attackers are counting on. The fix is behavioral as much as technical: hover over any meeting link before clicking, treat .ics attachments from unknown senders with suspicion, and make sure teams know that a calendar invite can be a phishing lure like any other email.
For IT admins, the pattern is a reminder to tighten calendar-invite handling in Microsoft 365 and to flag external invites landing directly on employee calendars. The next "quick sync" in your schedule might be worth a second look.
By Hamza Faisal
