Warning: Attackers Are Using Calendar Invite Files to Evade Security Filters
KnowBe4, Friday, October 23rd, 2026
KnowBe4 warns that phishing campaigns use ICS calendar invites to plant lures on calendars and bypass security filters.
KnowBe4 cites Netcraft research showing that attackers are sending ICS calendar invite files to place phishing lures directly on users' calendars.
The invites often pose as work meetings and can stay on the calendar even after the original email is deleted.
The technique is now built into popular phishing kits such as EvilTokens, making it easier for unskilled attackers to use.