EvilTokens

Phishing lures sent as ICS calendar invites land in Outlook and Gmail calendars without a click and stay after the email is deleted; EvilTokens used them for Microsoft 365 device-code phishing

Netcraft reports that attackers send phishing lures as ICS calendar files because the "text/calendar" type is treated as low risk by major email clients, and that the mail client's normal invite handling then places the lure in the victim's calendar with no user interaction, often keeping it there after the original email is deleted (Netcraft, 2026-10-16). In Netcraft's client table, Outlook desktop, Outlook on the web and Outlook Mobile with Exchange Online and Gmail with Google Calendar add the event automatically, mark it tentative and keep it after the email is deleted, Apple Calendar connected to Exchange Online often does the same, and Apple Mail with iCloud does not add it (Netcraft, 2026-10-16).

Campaigns using the EvilTokens toolkit, which steals Microsoft 365 tokens, used ICS invites disguised as meetings, alerts or voicemail notifications; the link leads to a page that gives the user a device code and tells them to enter it on Microsoft's device authorization page, which grants an attacker's device access to the account through OAuth (Netcraft, 2026-10-16). Netcraft now also sees smaller scams carrying ordinary phishing content inside ICS files (Netcraft, 2026-10-16). Sublime Security reports "exponential growth" in calendar phishing, with lures such as voicemail notices, payment receipts and renewal warnings that link to fake Microsoft, Google or PayPal logins or give a phone number, and Cofense says some senders use legitimate platforms such as Zoom to send the invitations, so filtering those platforms would also block real meetings (The Guardian, 2026-10-11).

Builds on: Huntress: device-code phishing and ROPC token-spray defeat M365 tenants by routing around the…