Attackers have used fake calendar invitations and Microsoft Teams meeting notices in an attempt to direct employees toward links designed to steal Microsoft login credentials. Check Point, a cybersecurity software company, said in a report that a new detection system flagged more than 302,000 phishing emails sent to over 40,000 organizations.
The researchers identified several large-scale campaigns using meeting invitations to disguise phishing links. Activity rose sharply from Sept. 25 and continued through Oct. 15, with the emails originating from tens of thousands of different sender domains.
Check Point also reported a steep increase in message volume. It recorded more than 118,000 emails in September, followed by more than 740,000 during the first two weeks of October. Nearly 200,000 were recorded on Oct. 8 alone.
How the fake invitations work
Check Point described two ways the phishing emails disguised malicious links as meeting invitations. Some emails contained an .ics attachment, the standard file format used to share calendar events. Although the invitation was malicious, the file itself contained valid calendar data.
Check Point said the attack works by placing deceptive content inside a legitimate calendar format rather than exploiting a software vulnerability. A recipient can encounter the phishing link as part of what appears to be an ordinary meeting request.
Other emails imitated Microsoft Teams meeting invitations. In an example published by Check Point, a link presented as a way to join a meeting pointed to a Microsoft authentication address rather than the displayed Teams URL. The researchers classified the message as a credential-phishing attempt.
Check Point identified more than 33,890 sender domains and more than 247,270 unique sender addresses in messages flagged by its detection system.
Check Point documented a similar use of routine workplace notifications in September. Its earlier research identified more than 58,000 fake voicemail-transcript emails sent to over 7,800 organizations during the second half of August. Those messages used malicious attachments to redirect recipients to phishing pages, although the delivery mechanism differed from the calendar campaigns.
How many accounts were compromised?
Check Point did not disclose how many recipients clicked the phishing links, entered login details or suffered confirmed account compromises.