How Attackers Used ICloud Calendar To Send Phishing Emails From Apple

11 September 2025by Cyber Shield Intelligence (CSI) Team

A new phishing campaign is abusing Apple’s iCloud Calendar invitation system to push malicious links. Because these invites are delivered directly from Apple’s own email servers, they easily slip past most email defenses and land straight in user inboxes

The attackers are banking on the trust people place in Apple’s brand. Calendar invites appear to come from legitimate Apple domains, but the Notes section is weaponized with phishing links

In multiple cases, the links redirected to fake Microsoft 365 login pages designed to steal credentials. Since the delivery is routed through Apple, the invites not only look authentic but also generate notifications across services like Microsoft Teams—making them even harder to dismiss as suspicious

Table of Contents

Invitation Functionality: How the Abuse Works

Technical Breakdown of the Campaign

Why Does It Pass Email Protection Solutions?

How Wizard Cyber Defends Against this Threat

Invitation Functionality: How the Abuse Works

Apple’s calendar service lets users send event invitations to outside contacts. By default, Apple sends these emails through noreply@email.apple.com on the user’s behalf. Attackers are now exploiting this feature by planting phishing URLs in the Notes field. Because the messages come from Apple’s infrastructure, spam filters and secure email gateways rarely flag them

Technical Breakdown of the Campaign

1. Invitation Email Example

The calendar invitation is styled as a normal meeting event with a title such as “CSI Team – WizardCyber” and includes a link in the Notes section:

Notes:

URL: http://[malicious-domain]/login

2. Cross-Platform Notification Abuse

Since the invites are trusted and authenticated, they don’t just arrive in the inbox—they also trigger alerts in linked platforms like Microsoft Teams. This increases the reach and makes the malicious content appear legitimate across multiple channels

Why Does It Pass Email Protection Solutions?

High Authentication Success Rate

The phishing messages successfully pass SPF, DKIM, and DMARC checks, which makes them appear authentic to both users and automated email security systems.

Since the emails are sent from a highly trusted domain (apple.com), the authentication results are:

SPF: pass (sender IP authorized)

DKIM: pass (signature matches)

DMARC: pass (domain alignment validated)

Sender IP: 17.111.10.43

From: noreply@email.apple.com

Uncommon Attack Vector

Calendar invitations are not typically associated with phishing, so users may not be as vigilant. Furthermore, the Notes section is often overlooked by email security scanners, making it an attractive location for embedding phishing content.

How Wizard Cyber Defends Against this Threat

As a Microsoft Partner and MSSP, Wizard Cyber helps organizations close gaps that traditional email defenses miss. We combine threat intelligence with proactive monitoring to stop phishing campaigns like this before they compromise accounts

Our services include:

Managed Microsoft Sentinel
CYBERSHIELD
24/7 Managed Detection and Response (MDR)
Advanced phishing detection and prevention (including protection against brand impersonation, domain spoofing, and spear-phishing)

Our global SOC team monitors activity around the clock, hunts for signs of compromise, and strengthens identity and access security to keep your business safe

CYBERSECURITY READINESS

Strengthen Your Cyber Defences Today

As cyber threats grow more complex, proactive detection is no longer optional.

With Wizard Cyber’s Microsoft expertise, organizations can transform their security posture and gain real-time visibility across all endpoints.

Start your journey to smarter, faster cybersecurity today.

EXPLORE MORE

Related Blogs & Insights

Discover blogs that deepen your knowledge and accelerate your security strategy.

CoPhish – New Phishing Technique Using CoPilot

CoPhish uses Copilot Studio to steal OAuth tokens via trusted Microsoft domains. Learn how the attack works and how to defend against it.

Trusted Services As Phishing Vectors: Techniques, Evasion, And Defensive Controls

Learn how attackers exploit trusted services for phishing and how Wizard Cyber detects and defends against these subtle threats.

When A Google Link Becomes A Trojan Horse: Dissecting A Redirect-to-Phish Campaign

Learn how attackers weaponize Google redirects in phishing campaigns and how to detect and stop redirect-to-phish attacks with Wizard Cyber.

ABOUT THE AUTHOR

Mahdi Alabdallah

Offensive Security Engineer

Mahdi specialises in penetration testing, web application security, network security assessments, and vulnerability exploitation. He holds the globally recognised OSCP (Offensive Security Certified Professional) certification, eCPPT, eWPT, and eCIR certifications, alongside Microsoft SC-200, SC-300, and AZ-500 certifications

Certifications: OSCP+/OSCP, eCPPT, eWPT, eCIR, SC200, SC300, AZ500

Cyber Shield Intelligence (CSI) Team

Wizard Cyber’s first line of defense in proactive threat intelligence. CSI is dedicated to the identification, monitoring, and analysis of emerging cyber threats, including activity across the dark web, underground forums, and threat actor infrastructure. Leveraging advanced threat intelligence platforms, OSINT tools, and adversary tracking methodologies, the team provides actionable intelligence to anticipate attacks before they occur. With expertise in threat actor profiling, TTP mapping (aligned with the MITRE ATT&CK framework), and IOC enrichment, CSI equips clients with the critical insights needed to fortify defenses, mitigate risk, and stay ahead of evolving threat landscapes.

Evading Detection: The Hidden Tricks Behind Today’s Phishing Attacks - Part1

CVE-2025-55241 - Azure Entra Elevation of Privilege via Actor Token Vulnerability

WIZARD CYBER