Malicious calendar invites surge, stealing Microsoft logins and pushing ScreenConnect
Original title: Quarantined, but still on your calendar: The explosion of invite-based attacks
Check Point counted more than 740,000 such emails in the first two weeks of October, up from a few thousand a month in April.
Check Point and Sublime Security say phishing that uses calendar invites has risen sharply, with Sublime reporting a 1,216% month-over-month increase in August 2026. Campaigns send valid .ics files or links that lead to spoofed Microsoft sign-in pages; Check Point says the attacks abuse calendar features and trust without exploiting a software flaw. In one Sublime case, a Google Calendar invite from Gmail led victims who bypassed download warnings to a roughly 10MB ScreenConnect installer used as the attacker’s command-and-control channel. Quarantining the email may still leave the meeting on the calendar because mail and calendar use different protocols.
Unconfirmed: The volume figures are vendor telemetry, and the ScreenConnect case is one Sublime example.
- The first half of September surpassed all of August by 1,426%, Sublime said.
- Check Point volume exceeded 118,000 messages in September.
- One lure used a Framer-hosted page and a financial theme.
- Google rewrites invite links through google.com, which can look legitimate.
- Defenders should remove the calendar event when they quarantine the email.
Impact: Microsoft credential theft or remote control through ScreenConnect
- 1.Cover calendar entries in email security and delete the event when quarantining the message.
- 2.Treat urgent invites from new free-mail senders and links to free site builders as suspicious.
- 3.Verify unfamiliar invites with the supposed sender on a separate channel before signing in or downloading.
- Products
- Google CalendarScreenConnect
- Organizations
- Check PointSublime Security
From the original article
3 min read at helpnetsecurity.com
There has been a sharp escalation in attacks that use malicious calendar invites to reach targets, email security providers Check Point and Sublime Security have warned. Sublime recorded a 1,216% month-over-month increase in August 2026, and the first half of September alone surpassed the whole of August by 1,426%.
By Zeljka Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.