In a nutshell: Tips for staying vigilant against phishing scams delivered via text messages, phone calls, and emails are likely common knowledge by now, but fraudsters are always looking for new attack vectors. Calendar invitations appear to be the latest tool of choice, exploiting widely used, trusted software that may not receive the same level of scrutiny from antivirus tools. As always, users should be wary of suspicious messages from unknown senders, regardless of the medium.

Security researchers at Sublime are warning users about a new phishing tactic targeting work calendars. Reports of these attacks have surged in recent months because the technique is inexpensive and more likely to reach end users.

As the company explained to The Guardian, a typical calendar phishing scam, also known as an ICS phishing attack, begins when a user notices an unfamiliar meeting invitation or a notification about a financial issue on their calendar. Like other phishing attempts, the invitation might contain a payment invoice or a QR code.

Assuming they have simply forgotten about the event, the target clicks a link in the calendar invitation and is redirected to a fraudulent website that may request login credentials or deliver malware. These scam pages and downloads frequently imitate popular services from Microsoft, Google, PayPal, and other well-known companies.

Attackers send these messages to users' email inboxes and calendars simultaneously to increase the chances of attracting their attention. Even if an email client's spam filter catches the malicious message, the calendar invitation may still get through because calendar services such as Google Calendar and Microsoft 365 handle invitations differently, particularly when configured to automatically add events from emails.

Source link