Fake Calendar Invite Malware Attacks Surge by Over 1,200% in August

Dramatic Increase in Calendar-Based Attacks

A new report from cybersecurity firm Sublime indicates a sharp rise in malware attacks delivered through fake calendar invitations. The firm observed a 282% increase in June, 338% in July, and a substantial 1,216% surge in August compared to the previous month. Projections for September suggest an even greater increase of 2,852% over August's figures.

Exploiting Default Email Settings

These attacks leverage a technique called ICS phishing, utilizing the iCalendar standard. ICS files, containing meeting details, are automatically added to users' calendars in many email programs such as Microsoft Outlook, Gmail, and Apple Mail, often before the user can accept or decline the invite. This bypasses typical email inbox security filters, as the event is added directly to the calendar.

Effectiveness and Trust Exploitation

The scams are effective because they target both the inbox and calendar, with calendar security often less robust than email security. Many attacks originate from trusted platforms like Google's and Microsoft's infrastructure, further aiding in evading detection. Scammers also utilize free services, incurring no cost for their operations. John Gallagher of Viakoo notes that the success of these attacks stems from the 'implied trust' in both the systems involved and the invitation itself, as calendar invites are generally less scrutinized than email phishing attempts.

Mitigation Advice

Users are advised not to respond to suspicious calendar invites or their associated emails. Instead, they should report and delete them. The automatic addition of these events to calendars means users may be unaware of their presence until they access their calendar.