Phishing lures sent as ICS calendar invites land in Outlook and Gmail calendars without a click and stay after the email is deleted; EvilTokens used them for Microsoft 365 device-code phishing
Calendar-invite phishing spreads: Outlook and Gmail add the lure on their own and keep it after the email is deleted
Analysis
Netcraft reports that attackers send phishing lures as ICS calendar files because the "text/calendar" type is treated as low risk by major email clients, and that the mail client's normal invite handling then places the lure in the victim's calendar with no user interaction, often keeping it there after the original email is deleted (Netcraft, 2026-10-16). In Netcraft's client table, Outlook desktop, Outlook on the web and Outlook Mobile with Exchange Online and Gmail with Google Calendar add the event automatically, mark it tentative and keep it after the email is deleted, Apple Calendar connected to Exchange Online often does the same, and Apple Mail with iCloud does not add it (Netcraft, 2026-10-16).
Campaigns using the EvilTokens toolkit, which steals Microsoft 365 tokens, used ICS invites disguised as meetings, alerts or voicemail notifications; the link leads to a page that gives the user a device code and tells them to enter it on Microsoft's device authorization page, which grants an attacker's device access to the account through OAuth (Netcraft, 2026-10-16). Netcraft now also sees smaller scams carrying ordinary phishing content inside ICS files (Netcraft, 2026-10-16). Sublime Security reports "exponential growth" in calendar phishing, with lures such as voicemail notices, payment receipts and renewal warnings that link to fake Microsoft, Google or PayPal logins or give a phone number, and Cofense says some senders use legitimate platforms such as Zoom to send the invitations, so filtering those platforms would also block real meetings (The Guardian, 2026-10-11).
Cited evidence
Threat actors are using ICS calendar invite files to bypass email security filters and often achieve persistence in targets’ calendars even after the original email is deleted.
Security teams may wish to review their default email client settings to ensure that employees who should not expect invites from outside of the organization would not have those automatically added to their calendars.
Calendar apps, such as Google Calendar, can add invitations automatically without users even accepting them
Sources2
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.