Fake Calendar Invites Are the New Phishing: Why .ics and Teams Lures Slip Past Your Instincts — and the CISO Playbook

The phishing email you were trained to distrust has put on a disguise your instincts never learned to doubt: a meeting invite. Check Point Email researchers (in a report dated 15 October 2026) describe a large, fast-growing campaign that abuses ordinary calendar features — malicious .ics attachments and fake Microsoft Teams invites — to steal Microsoft 365 credentials. The important part for defenders is what it is not: it is not a flaw in Outlook, Teams or the iCalendar format. It is the abuse of trusted calendar behaviour, which means there is no patch coming — only better habits, detection, and authentication.

Independent, third-party analysis for CISOs, email-security and identity teams. PlayCISO is not affiliated with Check Point. Every figure below is attributed to Check Point’s reporting; we have not independently verified Check Point’s numbers, and where the source is ambiguous we say so rather than assert.

What the campaign is

According to Check Point Email researchers, a new detection layer surfaced a wave of phishing that hides behind the one email object almost nobody double-checks: the calendar invite. Two variants dominate.

• Malicious .ics attachments. The invite arrives as a standard .ics calendar file. It is valid calendar data — that is the point — and it carries or links to a credential-harvesting destination.
• Fake Microsoft Teams invites. An ordinary email is dressed up as a Teams meeting request. In one Check Point example, the invite’s "join" link did not go to Teams at all — it pointed to a counterfeit Microsoft sign-in page built to capture the victim’s Microsoft 365 credentials.

Either way, the goal is the same: get a Microsoft 365 username and password typed into a page the attacker controls.

The scale, as Check Point reports it

These are Check Point’s figures, reported by Check Point (report dated 15 October 2026). We relay them with attribution and have not independently verified them.

Check Point also reports the volume climbing from a few thousand emails a month in April to more than 118,000 in September and more than 740,000 in the first two weeks of October. Two honest caveats on those two numbers, both ours rather than Check Point’s: the write-up describes them inconsistently (daily in one place, monthly in another), so lean on the trend — a steep, accelerating ramp — rather than treating the basis as settled; and the 740,000 two-week figure is a separate measurement from the 302,386 unique-phishing-emails figure — they count different things and must not be added together or conflated.

This is abuse of a feature, not a vulnerability

The single most important sentence a security leader can take from this: nothing in Outlook, Teams or the .ics format is being hacked.

A .ics file is legitimate calendar data. A Teams-styled invite is a legitimate-looking email. The attacker is not exploiting a parsing bug or an auth bypass — they are exploiting the trust people place in calendar invites and the fact that both humans and some mail defences scrutinise an invite far less than a bare link email. That distinction decides your response: there is no CVE to patch and no vendor fix to wait for. The levers are detection tuning, verification habits, and authentication that does not fall to a stolen password.

Why calendar invites slip past normal phishing instincts

1. Familiarity lowers the guard. A meeting invite is a routine, expected part of a workday. The suspicion people reserve for an unsolicited link or attachment simply does not fire for an invite.
2. The structure looks legitimate. A .ics is real calendar data; a Teams invite mimics a product used constantly. The branding and format "look right" at a glance — which is exactly why appearance proves nothing.
3. The call-to-action is disguised. The action is a "join meeting" button, not an obvious "log in here" link. And because invites can persist in a calendar, the lure can linger past the moment the triggering email is handled.

The habit that defeats all three is boring and reliable: Microsoft branding on a calendar invite proves nothing; only the verified sender and the real link destination do. Hover the link, read where it actually goes, and never type a password into a page you reached from an invite.

The CISO playbook

None of these defences are exotic — they are the fundamentals of beating credential phishing, applied to a surface people forgot to cover.

1. Verify sender and link destination before any sign-in. Make it the standing rule and reinforce it: check who actually sent the invite, and hover the real URL before trusting it. A "Teams" invite whose link points anywhere but a Microsoft domain is a phish. Our Email Authentication Lab walks through SPF, DKIM and DMARC so you can reason about which invites can be spoofed to look internal and which cannot.
2. Deploy phishing-resistant authentication. Passkeys and hardware FIDO2 security keys mean a captured password is not enough to get in — the single highest-leverage control against any credential-harvesting campaign. Our MFA Bypass Lab shows exactly which MFA types survive a credential phish and which do not.
3. Tune email and calendar monitoring for the campaign’s tells. Flag .ics attachments for closer inspection, newly-registered sender domains, and links whose destination does not match the service they name. The campaign’s 33,890 sender domains and 247,270 addresses mean sender reputation alone will not save you — destination mismatch is the stronger signal.
4. Widen awareness training. Most training targets link-in-body emails. Add meeting invites and .ics attachments explicitly, with real examples, so the invite surface is no longer a blind spot.
5. Rehearse triage and have a compromise runbook ready. Treat a reported calendar-invite phish like any other credential-phishing alert; our guide on how to triage a SOC alert gives the workflow.

Practise spotting it — two companion tools

Reading about a lure is not the same as recognising one in your inbox at 4pm on a Friday. We built two free tools alongside this post to close that gap:

• .ics Invite Inspector — paste a calendar invite (or its raw .ics) and it flags the risk signals: link destinations that don’t match the named service, suspicious attachments, sender/domain mismatches and the other tells described above.
• Calendar-Invite Triage Lab — a hands-on drill for practising the judgement call on realistic fake invites, so your team builds the instinct before a real one lands.

If credentials were entered — the incident steps

Then close the loop the durable way: move that user — ideally the whole tenant — onto phishing-resistant authentication, so the next password an invite steals is worth nothing.

The takeaway for leaders

Attackers did not find a new exploit; they found a new disguise. Calendar invites are trusted, routine, and under-inspected, and that is precisely why a credential phish wearing an invite’s clothes is landing in 40,000 organizations at a pace that, per Check Point, grew more than a hundredfold between April and October. You cannot patch trust. You can verify before you sign in, make a stolen password useless with phishing-resistant auth, and teach your people that a meeting invite deserves the same scrutiny as any other link. Do those three, and the disguise stops working.

Source

This post relays and analyses reporting from Check Point; it does not originate any of the figures above.

• Check Point — Fake Calendar Invites Target Thousands of Organizations in Microsoft Credential-Phishing Campaign (report dated 15 October 2026)