Accept, Then Sign In: Hunting The Calendar-Invite Phishing Surge In Microsoft 365

Phishing that arrives as a meeting invite has existed for years. What's changed is the volume. Check Point Research reports a campaign that went from a few thousand emails a month in April to more than 118,000 in September, then over 740,000 in the first two weeks of October. Its busiest day was 8 October, with almost 200,000 messages. More than 40,000 organisations have been targeted, and the goal is Microsoft 365 credentials.

This piece explains why calendar invites get through, what you can see in Microsoft Defender for Office 365 and Entra ID, and the controls that make the trick less useful.

How the campaign works

Check Point describes two variants, and neither needs an exploit or malware.

• An .ics attachment. The email carries a valid calendar file disguised as a meeting request or payment notification. The file itself contains no code, so it passes attachment scanning. Depending on the recipient's settings, opening or accepting it adds the event to their calendar, where it sits with a "join" link, a location field or a QR code that points to a fake Microsoft 365 sign-in page or a payment portal.
• A link styled as an invite. The message looks like a Teams meeting invitation, but the "Join" button leads to a credential-harvesting page on a third-party site. Email filters are more likely to catch this version.

The senders are spread out: Check Point counted more than 33,890 sending domains and 247,270 sender addresses. Blocking senders one by one won't keep up.

Why invites get through

Calendar items are trusted in a way that ordinary emails aren't. Three things work in the attacker's favour:

• The file is genuinely harmless. An .ics file is plain text. There's nothing for a sandbox to detonate, so the risk is in the URL or QR code inside the event description.
• The event outlives the email. Removing the message after delivery doesn't always remove the calendar entry. That's especially true for events created from an .ics attachment rather than a native meeting request. A user can still click the link from their calendar or a reminder days later.
• Meetings feel routine. People are trained to be suspicious of urgent password resets, not of a meeting with a finance team. A Teams-styled sign-in page that appears after clicking "Join" looks normal.

Hunting in Defender and Sentinel

These queries use the Defender XDR advanced hunting tables, which are also available in Microsoft Sentinel through the Defender XDR connector. Check Point hasn't published indicators for this campaign, so the queries look for behaviour rather than specific domains. They're starting points, and you'll need to allow for your organisation's normal external meetings.

1. Inbound external mail carrying .ics files

Start with who is sending calendar files to your users, and how many recipients each sender reaches. A first-time sender domain reaching many people is the pattern to look for.

EmailAttachmentInfo
| where Timestamp > ago(30d)
| where FileName endswith ".ics" or FileType =~ "ics"
| join kind=inner (
    EmailEvents
    | where Timestamp > ago(30d)
    | where EmailDirection == "Inbound"
    | project NetworkMessageId, Subject, SenderFromDomain, DeliveryAction, ThreatTypes
  ) on NetworkMessageId
| summarize Messages = dcount(NetworkMessageId), Recipients = dcount(RecipientEmailAddress),
            Subjects = make_set(Subject, 5), Delivered = countif(DeliveryAction == "Delivered")
          by SenderFromDomain
| order by Recipients desc

2. Clicks on links in messages that carried an invite

Safe Links records clicks in UrlClickEvents. Joining clicks back to invite-carrying messages shows who followed a link from one.

let InviteMsgs = EmailAttachmentInfo
    | where Timestamp > ago(30d)
    | where FileName endswith ".ics" or FileType =~ "ics"
    | distinct NetworkMessageId;
UrlClickEvents
| where Timestamp > ago(30d)
| where NetworkMessageId in (InviteMsgs)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough, Workload
| order by Timestamp desc

Links typed or scanned from a QR code in the calendar event won't appear here. That's one reason the sign-in hunt below matters.

3. Sign-ins soon after a click

If a user handed over their password, the attacker usually signs in within hours, often from hosting infrastructure. This Sentinel query finds successful sign-ins from addresses the user hasn't used in the previous 30 days, within six hours of a click from query 2.

let InviteMsgs = EmailAttachmentInfo
    | where Timestamp > ago(14d)
    | where FileName endswith ".ics" or FileType =~ "ics"
    | distinct NetworkMessageId;
let Clickers = UrlClickEvents
    | where Timestamp > ago(14d)
    | where NetworkMessageId in (InviteMsgs)
    | summarize ClickTime = min(Timestamp) by Upn = tolower(AccountUpn);
let KnownIPs = SigninLogs
    | where TimeGenerated between (ago(44d) .. ago(14d))
    | where ResultType == "0"
    | distinct Upn = tolower(UserPrincipalName), IPAddress;
SigninLogs
| where TimeGenerated > ago(14d)
| where ResultType == "0"
| extend Upn = tolower(UserPrincipalName)
| join kind=inner Clickers on Upn
| where TimeGenerated between (ClickTime .. (ClickTime + 6h))
| join kind=leftanti KnownIPs on Upn, IPAddress
| project TimeGenerated, Upn, IPAddress, Location, AppDisplayName,
          UserAgent, RiskLevelDuringSignIn, ClickTime

4. What happened next in the mailbox

For any account that query 3 flags, look for new inbox rules, forwarding and MFA method changes, which are the usual next steps in Microsoft 365 account takeover. Our guide to business email compromise covers those checks in more detail.

Controls that help

1. Quarantine external calendar files you don't expect. An Exchange mail flow rule can send inbound messages from outside the organisation to quarantine when they have an .ics attachment or are a calendaring message. Native meeting requests and .ics attachments need separate conditions. Add exceptions for the partner and customer domains you meet with regularly, and test before you enforce, because legitimate external invites will be caught too.
2. Turn on Safe Links for email and Office apps with time-of-click checks, and keep the "do not rewrite" list short. It won't see URLs typed in or read from a QR code.
3. Clean up both the message and the event. When you remove a campaign with Threat Explorer, check affected calendars as well. Events created from attachments may survive the message being deleted.
4. Make stolen passwords less useful. Phishing-resistant MFA such as passkeys or Windows Hello for Business, and Conditional Access policies for risky sign-ins, stop most attacks after the password has gone. Our guide to Conditional Access, MFA and Identity Protection explains the options.
5. Tell people about it. A short note saying "an unexpected invite from someone you don't know is a phishing email" and a clear way to report it will catch what filters miss. Make sure the report button works in Outlook's calendar view as well as the inbox.

How a managed SOC helps

• Email and identity in one place. A click in Defender for Office 365 means more when it's seen next to a sign-in from a new country an hour later. Our SOCs watch both, around the clock.
• Fast verdicts at volume. A campaign sending hundreds of thousands of messages produces a lot of user reports and alerts. CYBERSHIELD AI's Investigation Agent works each one to a verdict in an average of 3m 30s, and on the managed service a senior analyst signs off by default.
• Detections that follow the campaign. On Complete and Command, our threat hunting allocation means a new technique like this becomes a hunt across your tenant when the research appears, not after the first compromise.

If you'd like to know how many calendar invites from unknown senders reached your users this month, book a demo or talk to our team.