Fake Microsoft 365 Calendar Invites Target 40,000 Companies

Fake Microsoft 365 calendar invite phishing is surging: Check Point Research says attackers sent 302,386 malicious invites to 40,000+ organizations this month.

Image: Check Point

You probably accept calendar invites without a second thought. A meeting pops into your inbox, you click accept, and you move on with your day. Attackers know exactly that — and they are turning one of the most trusted, routine parts of your workday into a trap for stealing Microsoft account credentials.

In a report published on October 15, 2026, Check Point Research disclosed a large-scale phishing campaign that abuses fake calendar invitations to harvest Microsoft account logins. The numbers are startling, and the attack is deceptively simple: no malware, no software vulnerability — just a calendar invite that looks completely ordinary.

How the Fake Calendar Invite Attack Works

The campaign uses two delivery methods, and both are designed to blend into your normal workday. Neither one exploits a flaw in Microsoft Teams, Outlook, or the calendar format itself. Instead, they abuse the trust we place in ordinary meeting requests.

Method 1: The Malicious .ics Attachment

Some of the phishing emails arrive carrying an .ics file — the standard calendar-file format used to share events between calendar apps. Here is the clever part: the file contains valid calendar data, not a virus.

Because the data is technically legitimate, the email can sail right through many spam filters. Worse, the invite can drop the fake meeting directly onto your calendar, so the lure sits there on your schedule, visible and "legitimate-looking" long after you have forgotten the original email.

Image: Check Point

Method 2: The Fake Teams Meeting Link

The second approach is a bogus Microsoft Teams meeting invite. The "Join" button in the email looks like it leads to an ordinary Microsoft sign-in page. But when researchers hovered over the link, the real destination was exposed: a credential-harvesting page designed to capture the username and password you type in — not the real Microsoft login.

This is classic phishing dressed in work clothes. The invite does not ask you to download anything suspicious. It just asks you to do something you do every day: join a meeting.

Image: Check Point

The Campaign's Scale Keeps Growing

This is not a small-time operation with a handful of disposable email accounts. According to Check Point's Email researchers, the footprint shows a sprawling, well-resourced campaign:

• 302,386 unique phishing emails flagged by a detection layer built specifically to spot this attack
• More than 40,000 organizations among the customers' emails that received them
• 33,890 different sender domains and 247,270 unique sender addresses — the infrastructure is huge
• 8,319 emails per active day on average

And the trend is accelerating, not fading. Daily volume grew from a few thousand emails a month back in April to more than 118,000 in September — and then exploded to over 740,000 emails in just the first two weeks of October. The single busiest day so far was October 8, with nearly 200,000 emails sent.

A note on the numbers: the 302,386 figure is the count of unique phishing emails identified by Check Point's specialized detection layer among its customers' emails, while the 740,000 figure reflects the overall message volume the researchers observed. Either way, the shape of the data is the same — a massive October spike.

Check Point says the campaign was still active as recently as October 15, 2026, and researchers have documented several of these calendar-invite operations, including similar campaigns abusing other trusted automated messages like fake voicemail notifications.

How to Protect Yourself from Calendar Phishing

The good news: because this attack depends on tricking you rather than exploiting software, simple habits go a long way. Here is what you — and your team — can do:

• Hover before you click. On a desktop, hover over any "Join" or sign-in link to reveal its true destination. If it does not point to a microsoft.com address you recognize, stop.
• Check the sender. Look closely at the sender's email address. Attackers hide behind lookalike domains — one letter off from a real company name.
• Treat surprise invites with suspicion. Did you get a meeting invite from someone you have never spoken to, or for a meeting you never heard of? Verify through another channel — a quick message to the supposed organizer costs nothing.
• Do not type your password through an invite link. If an invite asks you to sign in, close it and open Microsoft 365 the way you normally do (your bookmarked login page or your company's portal), then check the meeting there.
• Report it. If your company has a "report phishing" button in Outlook, use it. Reporting helps email filters learn and protects your colleagues.
• Turn on multi-factor authentication (MFA). Even if a password gets stolen, MFA on your Microsoft account adds a second barrier the attacker usually cannot cross.

IT teams should also consider blocking auto-adding of calendar events from unknown senders and enabling advanced email filtering that inspects .ics attachments and calendar-invite links.

Why This Matters

A stolen Microsoft account is not just an email password. For most businesses, that one login opens the door to email, OneDrive files, Teams conversations, and cloud apps — everything an attacker needs for business email compromise, data theft, or a follow-on ransomware attack.

The calendar-invite trick works precisely because it targets routine behavior, not technical weaknesses. The attackers do not need to outsmart your software. They just need you to have a normal Tuesday. Staying alert to the ordinary-looking messages is now part of staying safe.

For more coverage of threats like this, see more cybersecurity news and more technology stories on Top Tech Today.

Sources: Check Point Research blog, eSecurity Planet, Hackread