Attackers are sending phishing lures as calendar invite files that drop straight onto the recipient's calendar, where the event can stay even after the original email is deleted. KnowBe4 reported on October 23, 2026 that the technique is now built into popular phishing kits, which makes it available to attackers with little skill.

Healthcare teams run on meetings, appointments, and vendor calls, so a new event on the calendar rarely gets a second look.

How a calendar invite phishing attack works

A calendar invite travels as an .ics file attached to an email. Many email clients read that file and add the event to the calendar automatically, with no click from the user.

The researchers KnowBe4 cited described why that matters: "the lure's injection into the target's calendar is a normal and intended behavior of their email client. In many email clients, this allows the invite to persist in the target's calendar even after the original phishing email is deleted."

Deleting the email doesn't finish the cleanup. The event, its link, and its reminders stay on the calendar until someone removes them.

Calendar-based phishing has other forms too. Paubox has covered a related technique where attackers add victims to Microsoft 365 Groups and use calendar reminders to keep the lure in front of them.

Related: Attackers abuse Microsoft 365 Groups to create phishing invitations

Why calendar invites get past filters and people

A filter looks for danger in the email body, its links, and its attachments. In this attack, the lure sits inside the calendar event, and the email client creates that event as part of its normal behavior.

Trinity College's security team saw the same thing in an October 2025 campus advisory. It warned that malicious invitations "bypass traditional email filters by embedding phishing content within calendar events that automatically appear in Outlook calendars," with urgent subjects like "Final Notice: Payroll Acknowledgment Required" and senders spoofed to look like the recipient's own address.

Staff aren't primed to look twice either. "Email-attached calendar invites are now so ubiquitous that the average user may barely scrutinize them," the researchers KnowBe4 cited wrote. "In fast-paced, tech-reliant workplaces, new events appearing in the calendar without manual entry have become normalized."

What happens after someone opens the event

The calendar invite is only the delivery step. KnowBe4 reported that invites tied to EvilTokens, a Microsoft 365 phishing kit, are often disguised as meetings, alerts, or voicemail notifications.

Following the link takes the user to an attacker's page with a device code and instructions to enter it on Microsoft's real sign-in page. That is device code phishing: the user signs in on a genuine Microsoft page and approves the attacker's session without ever handing over a password.

Go deeper: Device code phishing: the new face of Microsoft 365 account takeover in healthcare

What healthcare IT teams can do now

Calendar lures look routine, so most of the response is teaching staff what to check and closing the settings attackers rely on.

  • Tell staff that a calendar event can be a phishing lure, even if they don't remember opening the email that created it.
  • Teach the steps for a suspicious invite: don't open its attachments or click its links, report it to IT, and delete the event from the calendar.
  • Remove the calendar event as well as the email when you clean up a phishing message, since the event can outlast the email.
  • Ask anyone who clicked a link or entered details to reset their password right away and tell IT what happened.
  • Treat scheduling and booking links the same way. Researchers in a separate KnowBe4 report on fake booking pages put it simply: "Check the address, not the design."
  • Ask IT or your Microsoft 365 admin to turn off device code sign-in where no one needs it, and to limit notifications from external Microsoft 365 Groups.

Block the phishing email before the invite lands

Every one of these lures starts as an email, the same channel behind 170 healthcare email-related breaches reported in 2025, according to Paubox's 2026 Healthcare Email Security Report. Protecting the inbox is part of running HIPAA compliant email, alongside encrypting what staff send.

Paubox inbound email security uses generative AI to detect anomalies in sender behavior, tone, and context. It also automatically blocks attacks from lookalike domains and from compromised accounts posing as colleagues.