Threat reportPhishingTL-2026-0930
CalPhishing: Phishing Campaign Abusing Microsoft 365 Groups and Outlook Calendar Invites for Persistent Lures and EvilTokens Device-Code Session Theft
Fortra's Intelligence and Research Experts (FIRE) team documented an active 2026 phishing campaign that abuses legitimate Microsoft 365 Groups and Outlook calendar features rather than a software vulnerability. Attackers create attacker-controlled groups impersonating internal departments, add victims, and deliver lures through group mailboxes, shared files, and .ics calendar invites (CalPhishing) whose reminders keep the phish alive after the originating email is deleted.
Key facts for CalPhishing Outlook calendar lures
| Identifiers | TL-2026-0930 |
|---|---|
| Also known as | CalPhishing, Calendar Invite Phishing, Microsoft 365 Groups Phishing |
| Severity | HIGH |
| Exploitation status | Exploited in the wild |
| Affected products | Microsoft Microsoft 365 Groups; Microsoft Outlook / Exchange Online Calendar (iCalendar .ics handling); Microsoft Microsoft Entra ID OAuth device authorization grant (device code flow) |
| Tools | EvilTokens, Telegram phishing-kit marketplace |
| MITRE ATT&CK techniques | T1114 Email Collection, T1187 Forced Authentication, T1199 Trusted Relationship, T1204.001 Malicious Link, T1204.002 Malicious File, T1528 Steal Application Access Token, T1530 Data from Cloud Storage, T1539 Steal Web Session Cookie, T1550.001 Application Access Token, T1566 Phishing, T1566.001 Spearphishing Attachment, T1566.002 Spearphishing Link and 7 more in the attack flow |
| Motivation | FINANCIAL |
| Target sectors | enterprise, government, financial, healthcare, technology |
| Target regions | Global |
| Detection rules | 9 (1 shown free) |
| Sources | 8 cited sources |
Detection coverage for CalPhishing Outlook calendar lures
As of 2026-06-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0930 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.
Free detection: EvilTokens — Device-Code (ConsentFix) Sign-In and Stolen-Token Replay (C2 / Account Takeover)
Detects the EvilTokens device-code/ConsentFix phishing terminus: an OAuth device authorization grant (device code flow) sign-in followed by token replay from a different IP/location, indicating M365 session-token theft and MFA bypass via alternate authentication material. Flags device-code auth atypical for the user and rapid sign-in from a new IP using the issued token.
- Languages: Splunk SPL, Microsoft KQL, Sigma
- ATT&CK: T1528, T1539, T1550.001
- Data sources: azure:aad:signin, Microsoft Entra ID sign-in logs, Azure AD SigninLogs
- Severity: critical
- Confidence: high
Splunk SPL
index=azure sourcetype="azure:aad:signin"
| eval authProto=coalesce('authenticationProtocol','authProtocol',"")
| eval isDeviceCode=if(match(lower(authProto),"devicecode") OR match(lower(coalesce('originalTransferMethod',"")),"devicecode"),1,0)
| where isDeviceCode=1 OR isDeviceCode=true
| stats min(_time) as firstTime max(_time) as lastTime dc(ipAddress) as distinct_ips values(ipAddress) as ips values(appDisplayName) as apps values(deviceDetail.operatingSystem) as os by userPrincipalName
| where distinct_ips >= 2
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| table firstTime lastTime userPrincipalName distinct_ips ips apps os
| sort - distinct_ipsMicrosoft KQL
// Equivalent Sentinel KQL for cross-validation
SigninLogs
| where TimeGenerated > ago(24h)
| where AuthenticationProtocol == "deviceCode" or AuthenticationProcessingDetails has "deviceCode"
| summarize firstSeen=min(TimeGenerated), lastSeen=max(TimeGenerated), distinctIPs=dcount(IPAddress), ips=make_set(IPAddress, 10), apps=make_set(AppDisplayName, 10) by UserPrincipalName
| where distinctIPs >= 2
| project UserPrincipalName, firstSeen, lastSeen, distinctIPs, ips, apps
| sort by distinctIPs descSigma
title: EvilTokens OAuth Device Code Sign-In and Stolen Token Replay
id: 6f1c2a90-0a3d-4b7e-9c11-0930a1b2c303
status: experimental
description: Detects an OAuth device authorization grant (device code flow) sign-in consistent with EvilTokens/ConsentFix phishing, especially when followed by token replay from a new IP (MFA bypass via stolen session token)
references:
- https://www.fortra.com/blog/new-calendar-invite-phishing-campaign-ics-abuse-and-post-delivery-persistence
- https://attack.mitre.org/techniques/T1528/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/06/24
tags:
- attack.credential_access
- attack.defense_evasion
- attack.t1528
- attack.t1539
- attack.t1550.001
logsource:
product: azure
service: signinlogs
detection:
selection:
AuthenticationProtocol: 'deviceCode'
condition: selection
fields:
- UserPrincipalName
- IPAddress
- AppDisplayName
falsepositives:
- Legitimate device-code sign-ins from IoT/CLI tooling (Azure CLI, PowerShell device login)
level: highKnown false positives:
- Legitimate device-code sign-ins from Azure CLI / PowerShell device login
- IoT or smart-TV style app enrollment using device code flow
Tuning notes: Allowlist app IDs and service accounts that legitimately use the device code flow (Azure CLI, Visual Studio Code, kiosk enrollment). Escalate to critical when device-code auth is followed within minutes by a sign-in from a new ASN/country using the same session. Pair with Conditional Access token-protection alerts.
- CalPhishing — External M365 Group Add and Auto-Tentative Calendar Creation (Exploitation) · unlock with TL Creds
- CalPhishing — Weaponized .ics Fields and Reminder Persistence After Mail Remediation (Post-Exploitation) · unlock with TL Creds
- EvilTokens — Device-Code Phishing Followed by Token Replay From New IP (C2 / MFA Bypass) · unlock with TL Creds
- CalPhishing — Inbound External .ics Auto-Tentative Meeting (Exploitation, Sigma-primary) · unlock with TL Creds
- CalPhishing — Department-Themed External Group Add Granting Cross-Surface Footprint (Post-Exploitation, Sigma-primary) · unlock with TL Creds
- EvilTokens — OAuth Device Code Grant / Consent Phishing Sign-In (C2, Sigma-primary) · unlock with TL Creds
- CalPhishing — Inbound .ics Auto-Creates Tentative Meeting from External M365 Group (Exploitation) · unlock with TL Creds
- CalPhishing — Calendar Item Persists After Originating Mail Remediation (Post-Exploitation Persistence) · unlock with TL Creds
Indicators of compromise for CalPhishing Outlook calendar lures
As of 2026-06-23, Threadlinqs Intelligence tracks 19 indicators of compromise for TL-2026-0930.
Sample indicators (1 of 19)
- Domain:
groups[.]outlook[.]com
Defanged, TLP:CLEAR. Full set of 19 indicators: unlock with TL Creds.
How CalPhishing Outlook calendar lures works
The chain frequently terminates in the EvilTokens device-code phishing kit, which steals Microsoft 365 session tokens and bypasses MFA.
Fortra's Intelligence and Research Experts (FIRE) team identified a phishing campaign, active in early-to-mid 2026, that represents a shift from traditional inbox spoofing toward abuse of trusted Microsoft 365 collaboration workflows. Because the activity runs through Microsoft's own infrastructure and services rather than a spoofed sender, it evades much of the source-validation logic that both email security gateways and phishing-awareness training rely on.
Initial access begins when a target is added to, or invited into, an attacker-created or attacker-controlled Microsoft 365 Group. Group names, descriptions, and welcome messages are crafted to blend in with internal communications and to manufacture urgency or routine context, using themes such as 'IT Support,' 'HR Updates,' 'Finance Review,' 'Leadership Briefing,' and 'All Company,' or payroll updates, contract renewals, supplier requests, mandatory training, and invoice review. A single group join simultaneously grants the attacker a foothold across the victim's group mailbox, shared file storage, and calendar surface.
The campaign's signature component is CalPhishing (Calendar Phishing). A malicious calendar event in iCalendar (.ics) format is delivered to the victim's Outlook calendar. As soon as Outlook processes the .ics file it automatically creates a 'tentative' meeting on the calendar without any user interaction, and this occurs before email security tools scan the attachment. The attacker weaponizes standard calendar fields: SUMMARY to create urgency, LOCATION to reference attached files and appear legitimate, and DESCRIPTION to carry the phishing message and instructions (links, sign-in prompts, file references). The core security gap is post-delivery persistence: a soft delete, move to junk, or remediation of the originating email does not remove the meeting entry from the calendar itself, so scheduled reminders keep resurfacing the lure. Over time the event begins to look like an unfinished work task, and recurring reminders apply sustained psychological pressure that brings the malicious content back into view long after the email is gone.
Payload delivery across the group surfaces includes credential-harvesting links and sign-in prompts, QR codes pointing to credential-harvesting pages, macro-enabled documents shared through group collaboration, fake support processes inside shared documents, and themed lures including fake Microsoft 365 / domain renewal alerts mimicking GoDaddy and fake digital-signature requests mimicking DocuSign. Rather than harvesting static passwords, the campaign frequently pivots to token theft via device-code phishing (referred to with the ConsentFix technique), allowing the attacker to capture a valid Microsoft 365 session token and authenticate as the user even when MFA is enabled. This workflow is automated by the EvilTokens phishing kit, which is sold on Telegram and packages device-code/consent phishing and session-token capture so operators can compromise accounts despite multi-factor authentication.
Reported outcomes include credential theft, session/token capture, MFA bypass via stolen application access tokens, malware delivery, broad data exposure across the network, and follow-on social engineering. Defense requires looking well beyond initial email delivery: tracing the full chain (who created the group, who was added, what files were shared, and whether calendar entries remain after mail remediation) and achieving cross-surface visibility spanning mail, calendar, files, and identity/token activity.
MITRE ATT&CK techniques by tactic:
Collection
T1114 Email Collection; T1530 Data from Cloud Storage
Credential Access
T1187 Forced Authentication; T1528 Steal Application Access Token; T1539 Steal Web Session Cookie
Initial Access
T1199 Trusted Relationship; T1566 Phishing; T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link
Execution
T1204.001 Malicious Link; T1204.002 Malicious File
lateral-movement
T1550.001 Application Access Token
Resource Development
T1583.001 Domains; T1585.003 Cloud Accounts; T1588.002 Tool; T1608.005 Link Target
Reconnaissance
T1598 Phishing for Information; T1598.003 Spearphishing Link
stealth
Remediation for CalPhishing Outlook calendar lures
Immediate actions
- Block or tightly scope external Microsoft 365 Group notifications at the gateway, including the sender domain groups.outlook.com, to stop externally originated group notifications
- Hunt for recently created or externally controlled M365 Groups with department-style names (IT Support, HR Updates, Finance Review, Leadership Briefing, All Company) and review their membership and external owners
- Remediate the calendar event itself, not just the originating email: when removing a phishing mail with an .ics, also delete the resulting tentative calendar meeting and its reminders
- Revoke active Microsoft 365 sessions and refresh tokens for any user who interacted with a suspicious invite, and re-issue credentials
Workarounds
- Configure Outlook/Exchange to not auto-process .ics invites into tentative calendar events for external/untrusted senders where supported
- Update phishing-awareness training to cover unexpected group additions and calendar invites, emphasizing workflow distrust rather than source validation alone
Longer-term hardening
- Restrict who can create Microsoft 365 Groups and require approval for external members/owners
- Disable or restrict the OAuth device authorization grant (device code flow) where not required, and enforce Conditional Access / token protection to reduce device-code phishing and token replay
- Deploy cross-surface (mail + calendar + files + identity) detection and remediation so calendar entries are scanned and removed alongside email
- Block or sandbox macro-enabled documents delivered through group collaboration surfaces and inspect QR codes in messages and documents
Affected and fixed versions
- Microsoft — Microsoft 365 Groups
Vulnerable versions: Microsoft 365 (cloud) - Microsoft — Outlook / Exchange Online Calendar (iCalendar .ics handling)
Vulnerable versions: Outlook (Microsoft 365 cloud) - Microsoft — Microsoft Entra ID OAuth device authorization grant (device code flow)
Vulnerable versions: Microsoft 365 / Entra ID
Timeline of CalPhishing Outlook calendar lures
- CalPhishing / locked-ioc-19 activity reported as active in early 2026, abusing Microsoft 365 Groups and Outlook calendar invites to deliver persistent phishing lures.
- CalPhishing / locked-ioc-19 campaign first reported (per Hackread) as active in early 2026, using .ics calendar invites and device-code phishing to steal Microsoft 365 sessions.
- Reporting documented the locked-ioc-19 phishing kit sold on Telegram, automating device-code (ConsentFix) phishing to capture M365 session tokens and bypass MFA.
- Researchers detailed that Outlook auto-creates a 'tentative' meeting from the .ics file and that a soft delete or move to junk does not remove the calendar entry, enabling reminder-driven persistence.
- Cybersecurity News, GBHackers, CyberPress, Hackread, and Help Net Security reported on the M365 Groups + CalPhishing campaign and the locked-ioc-19 kit.
- Reporting documented specific lure subjects ('locked-ioc-17' mimicking GoDaddy, 'locked-ioc-7' mimicking DocuSign) and redirect chains routed through Cloudflare to evade scanners.
- Fortra's Intelligence and Research Experts (FIRE) team published analysis of the calendar-invite phishing campaign: '.ics abuse and post-delivery persistence'.
- Threat tracked by Threadlinqs Intelligence (TL-2026-0930) as an active trusted-workflow phishing campaign with no associated CVE.
Sources cited for CalPhishing Outlook calendar lures
- New Calendar Invite Phishing Campaign: ICS Abuse and Post-Delivery Persistence fortra.com · Vendor report · 2026-06-23
- MITRE ATT&CK T1566: Phishing MITRE · Research · 2026-06-23
- MITRE ATT&CK T1528: Steal Application Access Token MITRE · Research · 2026-06-23
- New Phishing Attack Abuses Outlook and Microsoft 365 Groups Features to Attack Users cybersecuritynews.com · News · 2026-06-23
- CalPhishing Scam Uses EvilTokens Kit, Outlook Invites to Steal M365 Sessions hackread.com · News · 2026-06-23
- CalPhishing Campaigns Use Outlook Calendar Invites to Deliver Persistent Phishing Lures gbhackers.com · News · 2026-06-23
- Hackers Abuse Outlook Groups and Microsoft 365 Collaboration Features for Phishing Attacks cyberpress.org · News · 2026-06-23
- Phishing hides in routine Microsoft 365 workflows Help Net Security · News · 2026-06-23
Drafted by the Threadlinqs research pipeline from 8 sources; published ; last updated —.
