Beware of This New Phishing Scam Lurking in Your Work Calendar. Attacks Are Up 33,000 Percent

These so-called calendar-based attacks are a new spin on phishing, and according to a report from cybersecurity company Sublime, they’re growing fast.

“This attack type has finally hit the mainstream,” Sublime threat detection engineer Mark Morris wrote in a blog post. “To really drive that point home, the increase [in attacks] from May to September is projected to be ~33,000%.”

It works like this. An event pops up on a victim’s calendar. Perhaps it comes from an unknown contact or, more insidiously, impersonates Zoom or spoofs a victim’s own company. Like other phishing schemes, the goal is to get victims to hand over credentials. The calendar invite itself does not give attackers access to a person’s entire calendar, nor does it automatically steal credentials. It’s a mechanism that exploits trusted infrastructure, meaning victims will likely have their guard down.

Weekly roundup of the latest in tech news

“If they want to, they could make it look like an internal invitation,” intelligence analysis manager at the cybersecurity firm Cofense, Max Gannon, tells the Guardian. “They can customize the content, maybe by adding the logo of your company.”

The invite will likely contain a malicious link or attachment, or request that a victim call a phone number to connect directly with scammers, which is known as callback phishing. These scams also typically include elements of urgency or financial loss or gain, according to Sublime.

One example, flagged in November by Sublime, is a calendar invite that informs potential victims that “a transaction of $599.89 has been successfully processed using your PayPal Wallet for a Bitcoin purchase.” It urges them to “call our customer support line” if they did not authorize the transaction or believe it was made in error. That’s an example of a callback phishing attack, delivered via calendar invite, which is an increasingly popular combination. According to Sublime’s 2026 Email Threat Research Report, calendar invite attacks accounted for almost 20 percent of callback phishing attempts in the fourth quarter of last year.