Quarantined, but Still on Your Calendar: The Explosion of Invite-Based Attacks
Help Net Security, Tuesday, October 20th, 2026
Malicious calendar invites carrying phishing links have surged, and invites can remain on calendars even after the email is quarantined.
Check Point and Sublime Security report a sharp rise in phishing delivered through calendar invites, with Check Point counting more than 740,000 such emails in early October versus a few thousand in April.
Attacks use valid .ics files or Google Calendar invites leading to spoofed Microsoft sign-in pages or, in one case, a ScreenConnect installer used for remote control, and because email and calendar use different protocols, an invite can land on the calendar even when the email is quarantined.
Teams should make sure email security covers calendar entries and that removing a malicious email also removes the event.
Red flags include first-time senders on free accounts, urgent financial themes and links to free site builders.