Honestly, this is one of the worst types of phishing attacks. We already hate having work meetings as it is, especially when they could have been an email. Then you get bombarded with fake invites, not knowing whether they are important, and you have to be hyper-vigilant about protecting your credentials; it’s easy to want to give up on work altogether.
Check Point researchers flagged 302,386 unique phishing emails after activity spiked on September 25, 2026, targeting over 40,000 organizations. The lures looked like ordinary meeting invites, including Microsoft Teams invitations. The links inside them led to fake Microsoft sign-in pages built to capture usernames and passwords. By the first two weeks of October, Check Point had counted more than 740,000 fake calendar invite emails, up from more than 118,000 in all of September and a few thousand a month in April.
Before we get into what this looks like and what to do about it, one clarification worth making: Check Point did not disclose how many recipients clicked the phishing links, entered login details, or suffered confirmed account compromises. The 302,000 figure represents detection among Check Point customers, not confirmed breaches. Regardless, the sheer number of threats detected tells you how widely distributed the campaign is and how fast it’s growing, even if it doesn’t tell you the conversion rate.
Why Meeting Invite Phishing Works When Normal Email Phishing Gets Caught
Most employees have absorbed at least some phishing awareness over the years. They know about suspicious sender addresses, urgent requests for credentials, and links that don’t match the displayed URL. These are the things people have been trained to look for, and email security tools have gotten reasonably good at flagging them too.
Calendar phishing sidesteps some of that skepticism because the attack abuses calendar features and user trust without exploiting a software vulnerability. A meeting invite that arrives in your inbox prompts a different mental response than a random email. You’re not evaluating it the same way. You’re looking at the organizer’s name, the subject line, and whether the time works.
Some of these emails arrive with an .ics file, a universal calendar file format, as an attachment. The file is valid calendar data. That’s the part that makes this particularly effective: there’s nothing technically wrong with the file itself. It’s a legitimate calendar format being used to deliver a malicious link. Email security tools that scan for malware in attachments may pass it through because the .ics file is doing exactly what .ics files are supposed to do.
The other method is simpler. Other emails imitated Microsoft Teams meeting invitations, with a link presented as a way to join a meeting pointing to a Microsoft authentication address rather than the displayed Teams URL. A recipient who doesn’t hover over the link before clicking ends up on a page that looks like a Microsoft sign-in. They enter their credentials, and now the attacker has them.
The Detail That Makes This Worse Than Most Phishing
When an email gets quarantined, it’s removed from your inbox. With a calendar phishing email that contains an .ics attachment, the sequence can be different. If the .ics file was processed before the email was quarantined, a calendar entry may already exist in the recipient’s calendar, complete with the malicious meeting link, even after the email itself has been pulled. The email is gone, but the calendar entry isn’t.
Quarantining the email isn’t sufficient if the calendar invite has already been accepted and is sitting on someone’s calendar waiting for them to click “Join Meeting” on the day of the supposed event. Security teams discovering this campaign need to check calendars, not just email queues.
Phishing campaigns like this are designed to bypass email security tools and employee awareness training.
A penetration test can show you how far an attacker with stolen Microsoft 365 credentials would get inside your environment. Talk to MainNerve about what that looks like.
What This Looks Like
The campaign Check Point tracked used two primary delivery methods.
The first is a fake Teams invitation. An ordinary email dressed up as a Teams meeting request, where a recipient who follows the meeting link is taken to a fake Microsoft sign-in page that records the username and password entered there. The email looks professional, with an organizer name, a subject line, and a button that resembles the Teams interface. Nothing about it screams phishing at first glance.
The second uses an .ics attachment. The file opens in your calendar application, adds a meeting entry, and includes a link to “join” the meeting. That link is what you have to watch out for.
Check Point identified more than 33,890 sender domains and more than 247,270 unique sender addresses in the flagged emails. This makes blocking by sender address essentially useless. There’s no single domain to block. The campaign is distributed across tens of thousands of sending addresses specifically to avoid that kind of detection.
What to Do About Meeting Invite Phishing
The defense for calendar phishing isn’t much different from the defense for other credential phishing, but what to look for differs, and employees who know what to watch for are much harder to fool.
A sign-in prompt is almost always a red flag. Joining a legitimate Microsoft Teams meeting doesn’t require you to enter your Microsoft credentials on a third-party page. If clicking a meeting link takes you to a page asking for your username and password, stop. A real Teams link opens the Teams client or the Teams web interface, authenticated through your existing session. A link that asks you to sign in before joining is the attack.
One caveat, however, is that if you don’t regularly use Microsoft products and aren’t logged in all the time, you may need to log in before joining a meeting. Always go to the official Microsoft login page to do that. Once you have that open session, you should be able to click the meeting link, and it will take you right to the meeting.
When it comes to links in these invites, hover before you click. The displayed URL in a calendar invite and the actual URL the link goes to can be different. Hovering over the link shows you the real destination. A Teams meeting link should point to teams.microsoft.com or a recognized Microsoft domain. Anything else is worth questioning before clicking.
Additionally, be skeptical of invites from people you don’t recognize. A meeting invite from someone you’ve never dealt with, especially one asking you to click a link and sign in, is something you should verify through a separate channel before engaging with it.
Check your calendar settings for automatic invite acceptance. Some calendar configurations automatically add meeting invites to your calendar when you receive them, even before you accept. Google Calendar and Outlook both have settings that control whether new requests are added automatically or only when the sender is known. Reviewing those settings reduces the chance that a malicious .ics file adds an event to your calendar before anyone looks at it closely.
If you already clicked the link and entered credentials, act immediately. Change your Microsoft password through Microsoft’s official site. More importantly, revoke active sessions through the Microsoft 365 admin console. A password change doesn’t terminate sessions the attacker may have already established. Revoking sessions does.
The organizations that navigate this environment well aren’t the ones that have stopped clicking on things. They’re the ones where employees know the specific tells for each attack type, such as a sign-in prompt that shouldn’t be there, a URL that doesn’t match the displayed link, or a meeting invite from an organizer nobody can verify. That knowledge is more useful than general suspicion, because general suspicion is hard to sustain and often generates false positives.
If you want to understand how your team would respond to this kind of lure, or what an attacker would be able to do with compromised Microsoft 365 credentials in your environment, that’s a conversation we’re glad to have. MainNerve has been helping organizations understand their real exposure for over 20 years. Reach out today for a free consult.
