New Calendar Phishing Scam Targets Professionals

Cybersecurity firm Sublime has reported a significant surge in calendar-based phishing attacks, with a projected increase of approximately 33,000 percent between May and September. This indicates a rapid proliferation of the attack method.

The new scams utilize tools like Microsoft Outlook and Google Calendar. An invitation appears in the victim's calendar, potentially mimicking legitimate events like Zoom meetings or even internal company functions. These invitations often contain a malicious link or attachment designed to steal user credentials.

Mark Morris, a threat detection engineer at Sublime, noted that this attack type has "hit the mainstream." He highlights that these attacks exploit trusted infrastructure, making victims more likely to lower their guard.

One observed scam involved a calendar invite claiming a $599.89 transaction was processed via PayPal for a Bitcoin purchase, urging the recipient to call a provided customer support number. Such "callback phishing" attempts delivered via calendar invites have become increasingly common. Sublime's research indicates these calendar attacks accounted for nearly 20 percent of callback phishing attempts in the final quarter of last year.