The Rising Tide of Calendar Phishing Attacks

Pete Thomas, a startup executive at Kapwork, now conducts a forensic investigation for every meeting he doesn’t recognize. His routine involves cross-referencing sender names against LinkedIn and inspecting URLs for red flags. This skepticism is becoming a workplace necessity as security firms like Sublime and Microsoft report a massive escalation in calendar-borne threats. Unlike standard email phishing, these invites land directly on a user’s schedule, often bypassing the standard security checks applied to traditional attachments.

For client-facing roles in sales or recruiting, the risk is acute. Aman Gairola of Say Design narrowly avoided a breach after receiving a fake meeting invite that mimicked a Google Drive interface with 9.5 out of 10 accuracy. Beyond simple credential theft, some attackers now use deepfake technology to impersonate trusted colleagues during live video sessions. Even compromised accounts of real people are being weaponized, as seen when mountaineer Jenn Drummond’s hacked account sent bogus court summons to her entire contact list.

Security experts argue that the burden of safety should not fall solely on the end-user. Matthew Woodyard of Okta notes that because these scams appear identical to legitimate communication, training is insufficient. Instead, he advocates for the adoption of phishing-resistant technologies like passkeys, which bind authentication to specific, verified websites. Until such security measures become the industry standard, the professional calendar remains a primary vector for sophisticated social engineering.