Phishing has found a new home in the workplace calendar. Security researchers at Sublime report a sharp rise in attacks that use calendar invitations to bypass traditional email filters and land directly on employee schedules.

What You Need to Know

Calendar invite phishing exploits the trust users place in their scheduling apps, which often lack the same scrutiny as email inboxes. Attackers send invitations with malicious links or attachments that appear legitimate because they come through a familiar platform. The low cost and high delivery rate make this technique attractive to cybercriminals, and many organizations are unprepared to detect it.

Why Calendar Invites Are a Growing Target

Email security tools have become adept at flagging suspicious messages, but calendar invitations often slip through because they are processed differently. Many email gateways treat calendar invites as trusted events rather than potential threats.

Sublime's researchers note that the attacks are inexpensive to launch and frequently reach end users without triggering alarms. This combination has led to an exponential increase in reports over recent months.

How the Attacks Work

The typical attack begins with a calendar invitation sent from a compromised or spoofed account. The invite may include a link to a fake login page or a file that installs malware when opened.

Because the invitation appears in the user's calendar alongside legitimate meetings, it can be mistaken for a real event. Users who click without verifying the sender may unknowingly hand over credentials or infect their device.

  • Spoofed sender: The invitation appears to come from a known contact or trusted service.
  • Malicious link: Clicking leads to a credential-harvesting page or malware download.
  • Urgency: The event title or description pressures the recipient to act quickly.
  • Legitimate-looking details: Meeting times, locations and agendas mimic real corporate communications.

The Limits of Current Defenses

Traditional email filters focus on message content and sender reputation, but calendar invites often bypass these checks because they are delivered through calendar protocols. Security teams may not have visibility into these events until after an incident occurs.

Sublime's findings suggest that many organizations lack specific controls for calendar-based threats. This gap leaves employees exposed even when their email security is robust.

Why This Matters

The surge in calendar invite phishing represents a shift in attacker tactics toward platforms that security teams overlook. For businesses, this means existing investments in email protection may not cover a critical attack vector.

Employees are directly affected because their daily workflows depend on calendars, making them more likely to trust invitations without suspicion. A successful attack can lead to data breaches, financial loss and reputational damage.

The broader implication is that security strategies must evolve beyond email to include calendaring systems and other collaboration tools. Organizations that fail to adapt could find themselves repeatedly compromised through this overlooked channel.