Google named the tactic in its June scams advisory, describing fake renewal notices placed straight onto people's calendars.

 

What happened

Google investigated what it calls "Calendar Phishing," where fake renewal notices were added directly to Google Calendar invites, in its fraud and scams advisory. The advisory groups it with other tactics that abuse trusted cloud productivity services to get past security filters. The invites show up as meetings, subscription renewals, payment confirmations, or account warnings. Some link to fake sign-in pages for Google, Microsoft, or PayPal. Others give a phone number to call about a charge. Calendar invitations arrive as email, so the same staff inboxes HIPAA compliant email programs protect are the way in.

 

Going deeper

A calendar setting does much of the work for the attacker. By default, Google Calendar adds invitations from anyone to a person's calendar, according to Google's admin documentation. The event can appear without the recipient opening an email or pressing accept. It then sits next to real appointments and sends reminders. The link is in the event description rather than the email body. One campaign impersonated a security software company's billing department. The calendar entries claimed the recipient had paid several hundred dollars for a renewal and gave a support number to call to dispute it.

 

What was said

Google said it "investigated 'Calendar Phishing' bypasses, where fake renewal notices were added directly to Google Calendar invites," in the advisory. The company said it continues to track and dismantle the infrastructure behind these phishing operations. The advisory also covered relay phishing pages that capture passwords and session cookies, and QR code phishing.

 

In the know

Calendar files have become a delivery method in their own right. Microsoft recorded calendar invitation payloads nearly quadrupling in June, in its quarterly email threat report. Calendar files are handled differently from ordinary attachments. They can put a link onto someone's calendar without the person opening anything, which gives them less chance to look at it first. Declining a suspicious invite can also confirm the address is active. Google's guidance is to open the event, select "Report as spam," and then delete it.

 

The big picture

Clinical schedules run on calendars, and many physicians and managers have assistants or schedulers working inside theirs, which widens who sees a planted event. Google Workspace administrators can now set which invitations appear automatically across the organization, according to Google's admin documentation. The options are invitations from everyone, invitations from known senders only, or invitations the user has responded to by email. Known senders are people in the same domain, in the user's contacts, or people they've interacted with before. The setting applies to future invitations, not events already on calendars. Departments that rarely receive outside meeting requests are an easy place to start with the known-senders option.

 

FAQs

Why don't email filters catch these?

The invitation itself often comes through a genuine calendar service, so it passes checks that look at the sender. The harmful link sits inside the event description.

 

Is it safe to decline a suspicious invitation?

Declining can tell the sender the address is active. Reporting it as spam and deleting it avoids that.

 

What's the risk in calling a number from a calendar event?

The person who answers is usually the scammer. They may ask for payment details or talk the caller into installing remote access software.

 

Does this only affect Google Calendar?

No. The advisory focuses on Google, but other calendar services accept invitations the same way. The same caution applies to any unexpected event.

 

What should staff do if they've already clicked?

Change the password for any account they signed in to, sign out of all sessions, and tell IT. If they called a number and installed software, disconnect the device from the network and report it straight away.