Fake meetings and renewal reminders are turning up in people’s calendars with links to fake login pages, and one email security firm says the trick is spreading fast, the Guardian reported on Sunday. If your team uses Google Workspace or Microsoft 365 calendars, it’s worth ten minutes of your IT lead’s time.
What’s been reported
The report, published on 11 October, describes an entry for a meeting you don’t remember booking, linking to a sign-in page run by scammers.
Luke Wescott, a threat detection engineer at Sublime Security, told the paper that calendar phishing is still fairly new but that Sublime has seen “exponential growth”. The entries arrive as ordinary calendar invitations sent by email, and according to Wescott, apps such as Google Calendar can add them automatically, even if nobody opens the email or it goes to spam.
The Guardian’s examples include fake meetings, voicemail notifications, payment receipts and software renewals. Each one usually carries a link to a fake Microsoft, Google or PayPal sign-in page, or a number for a fake support line. Max Gannon of Cofense told the paper that some are sent through legitimate platforms such as Zoom, which makes them hard to block, and can be made to look internal.
These are real campaigns. The report gives no figures for how many people have been caught out, in the UK or elsewhere. The researchers were clear on one limit: an event on your calendar doesn’t give the scammers access to it. Nothing happens until someone clicks the link or rings the number.
What Google and others have said
The Guardian’s report doesn’t include comment from Google, Microsoft, PayPal or Zoom.
Google announced on its Workspace Updates blog on 14 August that admins can now limit which options staff may choose, including for existing users. The control is set to “From everyone” by default. The announcement predates the Guardian piece and doesn’t refer to it.
What it means for you
In our view, the Mac isn’t where this gets fixed. Calendar on macOS, iPhone and iPad shows whatever Google or Microsoft has already put on the calendar, so the setting lives in your Workspace or Microsoft 365 admin, and your DMS (formerly MDM) can’t change it for you.
In our view, the Mac isn’t where this gets fixed. Calendar on macOS, iPhone and iPad shows whatever Google or Microsoft has already put on the calendar, so the setting lives in your Workspace or Microsoft 365 admin, and your DMS (formerly MDM) can’t change it for you.
What the scammers want is a working sign-in, and at an agency that’s usually the account holding client email, shared drives and invoice threads. With that, someone can reply from a real address, which is how a phished password ends up as a “supplier” asking finance to update bank details.
Two other things help. 1Password only fills in a login on the site it was saved for, so a fake Microsoft page gets an empty form. And we’d lean towards passkeys over texted codes where your systems support them, because better phishing kits can relay one-time codes to the real site.
If you’re not sure how your calendars and sign-ins are set up across the team, we’re happy to take a look.
What we’d do now
On Google Workspace, move everyone off “From everyone”. We’d go with known senders for most agencies, since colleagues’ and regular clients’ invites keep flowing:
- In the Google Admin console, go to Menu, Apps, Google Workspace, Calendar, then Advanced settings.
- Set the least restrictive level to Invitations from known senders, set the default to the same, and click Save.
- Allow up to a day for it to apply. Events already on calendars stay put, so clear out anything suspicious by hand.
On Microsoft 365, there’s no single switch in the admin centre, so it’s a job for whoever manages your tenant:
- Connect to Exchange Online PowerShell with an admin account.
- Set automatic calendar processing to off (AutomateProcessing to None) on each mailbox, scripting it across all of them.
- Test on one mailbox first, and recheck now and then, because mailbox owners can switch it back on.
- Give staff one simple rule (yes, another one): don’t click links or ring numbers in a calendar entry you don’t recognise. Wescott also advises against pressing decline, since it can tell the sender your address is live. Delete it or report it as spam.
- Check that MFA covers every account, including the shared and admin logins that tend to get missed.
