Calendar Phishing Scams Show Exponential Growth, Exploiting Auto-Add Features

Rise of Calendar Phishing

Calendar phishing is a growing scam where fraudulent entries appear in users' electronic calendars. Luke Wescott, a threat detection engineer at Sublime Security, reports "exponential growth" in this type of attack. These entries often mimic legitimate events like meetings or service renewal prompts, aiming to trick users into clicking malicious links.

Exploiting Auto-Add Features

The scam leverages a feature in calendar applications, such as Google Calendar, that automatically adds invitations without user acceptance. This means scammers do not need users to open an email; the malicious entry appears directly in the calendar. This method bypasses typical email security measures and creates a false sense of credibility for the fraudulent entry.

Tactics and Impact

When a user clicks on a fake calendar entry, they are directed to a website that requests login details. Providing these details compromises the user's credentials, which can then be sold or used for further attacks like accessing work emails or impersonating institutions. Max Gannon, an intelligence analysis manager at Cofense, notes that some scammers use legitimate platforms like Zoom to send invitations, making them harder for both users and AI-backed security blockers to detect.

Common Scam Titles

Examples of fake calendar entry titles seen include "New voicemail received," "Payment receipt confirmation – $298.99," and "PayPal unusual activity warning." These titles are designed to create urgency or curiosity, prompting users to interact with the malicious link.