GoKawiilICS calendar-invite phishing attacks spike over 1,200% since June, Sublime reports
Security firm Sublime found that malicious calendar invites sent via email, known as ICS phishing, have surged dramatically, rising 282% in June, 338% in July, and 1,216% in August, with a projected 2,852% jump in September. These fake invites exploit a default feature in Outlook, Gmail, and Apple Mail that auto-adds ICS files to a user's calendar before they accept or decline them.
GoKawiil's interpretation of the reporting above, not reported fact.
Email security tools are largely built to scan inboxes, not calendars, so a malicious invite can slip past filters and sit unnoticed on a victim's schedule. Because calendars are a blind spot for most defenses, this technique gives attackers a second, less-monitored entry point into a person's device and organization.
- ICS calendar invites can carry malware and are increasingly used in phishing campaigns.
- Many email clients automatically add invites to calendars before users review them, bypassing typical inbox security checks.
- Users should avoid interacting with suspicious invites and instead report and delete them without clicking links or replying.
Yubico YubiKey 5C NFC Security Key — As calendar-invite phishing surges, hardware security keys add a strong layer of protection against account takeover even if you click a malicious link. The YubiKey supports FIDO2/U2F for Microsoft, Google, and other accounts, making it much harder for attackers to hijack your email or calendar after a phishing attempt. It's a simple, durable way to harden your accounts against the exact kind of social-engineering attacks described in the article.
See Yubico YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: zdnet.com — Lance Whitney, 2026-09-18
Published there as: “Fake calendar invites can infect your system, and they’re surging – how to protect yourself”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.