CalPhishing Campaigns Use Outlook Calendar Invites to Deliver Persistent Phishing Lures

A growing trend in which attackers weaponize Microsoft 365 collaboration features to deliver persistent phishing lures via Outlook calendar invites.

By abusing Microsoft 365 Groups and Outlook calendar functionality, threat actors move malicious intent out of a single suspicious message and into routine productivity workflows, increasing the chance that targets will treat the interaction as legitimate and eventually take an action that compromises security.

The attack begins when an adversary creates or controls a Microsoft 365 Group and adds the target as a member or sends an external invite.

Group names such as “IT Support,” “HR Updates,” “Finance Review,” or “All Company” provide plausible context, and the initial welcome message often appears technically clean because it originates from Microsoft-controlled services rather than a spoofed sender.

That apparent legitimacy is the bait: once the group membership exists, follow-up content can be delivered through the group mailbox, shared files, or critically Outlook calendar invites.

FIRE describes four CalPhishing techniques that move the lure from email to calendar, where event entries, reminders, and persistent notifications repeatedly surface the malicious content.

Calendar-based phishing CalPhishing turns an otherwise transient phishing email into a persistent work item. Attackers send malicious .ics invites or create calendar events framed as legitimate meetings, deadlines, support tasks, or administration notices.

Fortra Intelligence and Research Experts (FIRE) is tracking phishing activity that abuses Outlook Groups and Microsoft 365 collaboration features to make malicious activity appear routine.

Even if a recipient deletes the original message, the calendar event and its reminders remain, re-exposing the victim to the lure over time.

CalPhishing Campaigns Use Outlook Calendar

Event descriptions can contain links to credential-harvesting pages, instructions to download files, or references to shared documents that host malicious macros or remote-access guidance.

Because the content arrives through Microsoft collaboration surfaces, users are more likely to trust it and follow through: accepting an invite, clicking a link in the event body, opening a shared file, or authenticating to a fake SSO page can lead to credential theft, token capture, malware delivery, data exfiltration, or chained social-engineering attacks.

The operational impact is twofold: higher success probability from repeated exposure, and a reduced likelihood of detection because security teams focusing solely on inbound mail may miss activity that lives in group mailboxes, shared drives, or calendar objects.

Effective investigation therefore requires cross-surface visibility: defenders should track group creation, membership changes, messages sent, files shared, calendar events created, and whether calendar entries persist after mail remediation.

Blocking single sender addresses is insufficient; FIRE recommends, where mail flows permit, blocking group-origin notifications from external sources such as “groups.outlook.com” to reduce unwanted group invitations.

Defenders can and should treat CalPhishing as a workflow threat rather than a single-message phishing incident. Safe simulations that emulate the entire chain group invite, welcome message, shared content, calendar invite, and reminder cadence help measure exposure and coverage across Microsoft 365.

Test scenarios should record delivery, exposure, interaction rates, reporting behavior, and detection telemetry so controls may be tuned around group creation permissions, external membership policies, trusted sender changes, file sharing rules, calendar artifact monitoring, and user-reporting mechanics.

User education must adapt: unexpected groups, calendar items, or shared files deserve the same skepticism as unknown attachments or links.

The central lesson is that attackers no longer need sophisticated spoofing when they can borrow legitimacy from Microsoft 365 itself.

Outlook Groups abuse and CalPhishing are emblematic of a broader shift in adversary tactics turning everyday collaboration tools into reliable phishing delivery channels and defenders who expand visibility across mail, group, file, and calendar surfaces will be better positioned to detect and disrupt these campaigns before they escalate into incidents.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.