Check Point: fake calendar invites hit 40,000+ organizations in a Microsoft 365 credential phishing campaign

On October 15, Check Point’s email researchers published numbers from a detection layer they built for one specific trick: fake calendar invites that steal Microsoft 365 credentials. The layer flagged more than 302,386 unique phishing emails across more than 40,000 organizations since the surge began on September 25, with more than 740,000 sent in the first two weeks of October alone. Nothing in the attack exploits a software vulnerability. Check Point says it “abuses calendar features and user trust” — the .ics file is valid calendar data that filters let through, and the payload lives inside the calendar entry itself, pointing at a spoofed Microsoft login page.

Key points

• Check Point’s detection layer flagged 302,386+ unique phishing emails sent to 40,000+ organizations; the messages came from 33,890+ distinct sender domains and 247,270+ sender addresses, averaging 8,319+ per active day (Check Point, Oct 15).
• Volume after the September 25 ramp-up: 118,000+ in September, 740,000+ in the first two weeks of October, and a single-day peak of almost 200,000 on October 8. In April the same technique was running at a few thousand per month.
• Two payload shapes: a malicious .ics attachment, and a fake Microsoft Teams meeting invite whose “Join” link resolves to a credential-harvesting page on a third-party site dressed up as login.microsoft.com.

Background

The Guardian’s October 11 reporting explains the calendar phishing mechanism more plainly than any of the detection numbers. Luke Wescott, a threat detection engineer at Sublime Security, says apps like Google Calendar can add invitations automatically without the user accepting them, “so scammers don’t even need you to open an email.” Once the fake event is in your calendar, it sits next to real entries like a dentist appointment or a 1:1 with your manager, which lends it a legitimacy no email attachment ever gets. Max Gannon, intelligence analysis manager at Cofense, added that some phishers route invitations through Zoom and similar legitimate platforms, fooling recipients and security software alike.

The ramp had earlier signals. Check Point’s data puts the same technique at a few thousand emails per month in April, 118,000+ in September, and 740,000+ in the first two weeks of October. TechRadar’s October 16 report notes that Check Point sounded the alarm for “several large-scale phishing campaigns,” of which calendar invites are one family. Check Point’s own blog names another disguise in the same family: attackers also abuse other trusted, automated messages, such as fake voicemail notifications with malicious attachments.

The facts

Check Point’s October 15 blog, as measured by their own detection layer across their customers’ mail:

Metric	Value
Unique phishing emails flagged	302,386+
Organizations targeted	40,000+
Distinct sender domains	33,890+
Unique sender addresses	247,270+
Average per active day	8,319+
September (ramp-up month)	118,000+
First two weeks of October	740,000+
Busiest single day	October 8, almost 200,000

Two delivery paths carry the payload. One is a malicious .ics attachment titled as a meeting request or a payment notification; TechRadar’s description is that the file type itself is harmless, so filters let it through. Once the entry lands in the calendar, links hide in the event description and the location field, and TechRadar additionally mentions an embedded QR code as another hiding place. The second path is a fake Teams meeting invite where the “Join” button’s real destination is a credential-harvesting page on a third-party site. The Guardian describes the same family: a link or phone number in the event description, the link going to a spoofed Microsoft, Google, or PayPal login, the number connecting you to a fake agent who wants to “cancel a charge that never actually happened.”

Two details in TechRadar’s report are not in Check Point’s blog: the messages come from compromised email addresses, and what lands on the user is either a fake Microsoft 365 sign-in page or a fraudulent payment portal. Check Point’s own framing is that the campaign deploys no malware and exploits no vulnerability.

What others say

The three sources don’t contradict each other, but they cover different ground. Check Point describes only the Microsoft-focused round its own layer measured, with numbers and no cross-vendor claim. TechRadar, reporting Check Point’s findings, adds the multiple payload hiding places and the fact that the senders are compromised addresses. The Guardian widens the lens to calendar phishing as a category. Wescott’s characterization is that it is “the same technique, just using a different delivery method,” and he draws a clear line on when you’re actually hurt: “Until you click on this, or make a call, you are not compromised.”

On the auto-add defaults, Wescott’s advice is concrete: turn off automatic acceptance so only known senders get through, and don’t click “decline” on a suspicious invite, because that tells the sender the address is live — “Instead, delete or report it as spam/junk.” Gannon’s summary is darker on the detection side: routing invitations through legitimate platforms like Zoom makes blocking hard, “Even AI-backed blockers struggle,” and you can’t block those platforms outright because “that would also block any legitimate meeting invitations.”

Our take

Whether this campaign deserves a dedicated rule depends on what your Microsoft 365 accounts can reach. A generic employee mailbox costs you that mailbox and the files in it; a shared admin, a mail-flow permission, or an Azure subscription costs you tenant-wide lateral movement. The Guardian’s account of what happens next is blunt: you have handed your name and password to fraudsters “who will sell it on in a batch with other people’s details, use it to break into your work email,” or to impersonate your bank. Security teams should treat this as its own detection rule rather than waiting for generic reputation-based filtering to catch up — 33,890+ domains and 247,270+ addresses is a sprawl no domain reputation list tracks cleanly.

One honest caveat on the numbers: Check Point’s 40,000+ organizations were targeted, not confirmed breached. Those two figures are a world apart and shouldn’t be blurred in a summary. And the “exponential growth” Wescott describes in the Guardian is qualitative — there’s no public statistic behind it, so it can’t be stacked onto Check Point’s counts.

For ordinary users, the durable fix is a phishing-resistant credential. This site covered the same territory in Passkeys are not a trap, says Scott Helme: TOTP can be relayed in real time by tools like Evilginx, while a passkey is bound to the domain that issued it and can’t be. That is the opposite of what this campaign is trying to collect.