CalPhishing: Phishing Campaign Abusing Microsoft 365 Groups and Outlook Calendar Invites for Persistent Lures and EvilTokens Device-Code Session Theft
CalPhishing: Phishing Campaign Abusing Microsoft 365 Groups (TL-2026-0930), also tracked as CalPhishing, is a high-severity phishing campaign, first published 2026-06-23. It has no confirmed attribution, affects Microsoft Microsoft 365 Groups, maps to 19 MITRE ATT&CK techniques (T1114, T1187, T1199), and is covered by 9 detection rules and 19 indicators of compromise.
Key facts for TL-2026-0930
- Threat ID
- TL-2026-0930
- Also known as
- CalPhishing, Calendar Invite Phishing, Microsoft 365 Groups Phishing
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- 2026-06-23
- Last reviewed
- 2026-06-23
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- enterprise, government, financial, healthcare, technology
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 19
Malware and tooling in CalPhishing: Phishing Campaign Abusing Microsoft 365 Groups
Malware and tooling: EvilTokens, Telegram phishing-kit marketplace
Fortra's Intelligence and Research Experts (FIRE) team documented an active 2026 phishing campaign that abuses legitimate Microsoft 365 Groups and Outlook calendar features rather than a software vulnerability. Attackers create attacker-controlled groups impersonating internal departments, add victims, and deliver lures through group mailboxes, shared files, and .ics calendar invites (CalPhishing) whose reminders keep the phish alive after the originating email is deleted. The chain frequently terminates in the EvilTokens device-code phishing kit, which steals Microsoft 365 session tokens and bypasses MFA.
How CalPhishing: Phishing Campaign Abusing Microsoft 365 Groups works
Fortra's Intelligence and Research Experts (FIRE) team identified a phishing campaign, active in early-to-mid 2026, that represents a shift from traditional inbox spoofing toward abuse of trusted Microsoft 365 collaboration workflows. Because the activity runs through Microsoft's own infrastructure and services rather than a spoofed sender, it evades much of the source-validation logic that both email security gateways and phishing-awareness training rely on.
Initial access begins when a target is added to, or invited into, an attacker-created or attacker-controlled Microsoft 365 Group. Group names, descriptions, and welcome messages are crafted to blend in with internal communications and to manufacture urgency or routine context, using themes such as 'IT Support,' 'HR Updates,' 'Finance Review,' 'Leadership Briefing,' and 'All Company,' or payroll updates, contract renewals, supplier requests, mandatory training, and invoice review. A single group join simultaneously grants the attacker a foothold across the victim's group mailbox, shared file storage, and calendar surface.
The campaign's signature component is CalPhishing (Calendar Phishing). A malicious calendar event in iCalendar (.ics) format is delivered to the victim's Outlook calendar. As soon as Outlook processes the .ics file it automatically creates a 'tentative' meeting on the calendar without any user interaction, and this occurs before email security tools scan the attachment. The attacker weaponizes standard calendar fields: SUMMARY to create urgency, LOCATION to reference attached files and appear legitimate, and DESCRIPTION to carry the phishing message and instructions (links, sign-in prompts, file references). The core security gap is post-delivery persistence: a soft delete, move to junk, or remediation of the originating email does not remove the meeting entry from the calendar itself, so scheduled reminders keep resurfacing the lure. Over time the event begins to look like an unfinished work task, and recurring reminders apply sustained psychological pressure that brings the malicious content back into view long after the email is gone.
Payload delivery across the group surfaces includes credential-harvesting links and sign-in prompts, QR codes pointing to credential-harvesting pages, macro-enabled documents shared through group collaboration, fake support processes inside shared documents, and themed lures including fake Microsoft 365 / domain renewal alerts mimicking GoDaddy and fake digital-signature requests mimicking DocuSign. Rather than harvesting static passwords, the campaign frequently pivots to token theft via device-code phishing (referred to with the ConsentFix technique), allowing the attacker to capture a valid Microsoft 365 session token and authenticate as the user even when MFA is enabled. This workflow is automated by the EvilTokens phishing kit, which is sold on Telegram and packages device-code/consent phishing and session-token capture so operators can compromise accounts despite multi-factor authentication.
Reported outcomes include credential theft, session/token capture, MFA bypass via stolen application access tokens, malware delivery, broad data exposure across the network, and follow-on social engineering. Defense requires looking well beyond initial email delivery: tracing the full chain (who created the group, who was added, what files were shared, and whether calendar entries remain after mail remediation) and achieving cross-surface visibility spanning mail, calendar, files, and identity/token activity.
MITRE ATT&CK techniques used in TL-2026-0930
Collection
T1114 Email Collection; T1530 Data from Cloud Storage
Credential Access
T1187 Forced Authentication; T1528 Steal Application Access Token; T1539 Steal Web Session Cookie
Initial Access
T1199 Trusted Relationship; T1566 Phishing; T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link
Execution
T1204.001 Malicious Link; T1204.002 Malicious File
lateral-movement
T1550.001 Application Access Token
Resource Development
T1583.001 Domains; T1585.003 Cloud Accounts; T1588.002 Tool; T1608.005 Link Target
Reconnaissance
T1598 Phishing for Information; T1598.003 Spearphishing Link
stealth
Affected products and versions in CalPhishing: Phishing Campaign Abusing Microsoft 365 Groups
- Microsoft — Microsoft 365 Groups
Vulnerable versions: Microsoft 365 (cloud) - Microsoft — Outlook / Exchange Online Calendar (iCalendar .ics handling)
Vulnerable versions: Outlook (Microsoft 365 cloud) - Microsoft — Microsoft Entra ID OAuth device authorization grant (device code flow)
Vulnerable versions: Microsoft 365 / Entra ID
Remediation for CalPhishing: Phishing Campaign Abusing Microsoft 365 Groups
Immediate actions
- Block or tightly scope external Microsoft 365 Group notifications at the gateway, including the sender domain groups.outlook.com, to stop externally originated group notifications
- Hunt for recently created or externally controlled M365 Groups with department-style names (IT Support, HR Updates, Finance Review, Leadership Briefing, All Company) and review their membership and external owners
- Remediate the calendar event itself, not just the originating email: when removing a phishing mail with an .ics, also delete the resulting tentative calendar meeting and its reminders
- Revoke active Microsoft 365 sessions and refresh tokens for any user who interacted with a suspicious invite, and re-issue credentials
Workarounds
- Configure Outlook/Exchange to not auto-process .ics invites into tentative calendar events for external/untrusted senders where supported
- Update phishing-awareness training to cover unexpected group additions and calendar invites, emphasizing workflow distrust rather than source validation alone
Longer-term hardening
- Restrict who can create Microsoft 365 Groups and require approval for external members/owners
- Disable or restrict the OAuth device authorization grant (device code flow) where not required, and enforce Conditional Access / token protection to reduce device-code phishing and token replay
- Deploy cross-surface (mail + calendar + files + identity) detection and remediation so calendar entries are scanned and removed alongside email
- Block or sandbox macro-enabled documents delivered through group collaboration surfaces and inspect QR codes in messages and documents
Timeline of CalPhishing: Phishing Campaign Abusing Microsoft 365 Groups
- CalPhishing / EvilTokens activity reported as active in early 2026, abusing Microsoft 365 Groups and Outlook calendar invites to deliver persistent phishing lures.
- CalPhishing / EvilTokens campaign first reported (per Hackread) as active in early 2026, using .ics calendar invites and device-code phishing to steal Microsoft 365 sessions.
- Reporting documented the EvilTokens phishing kit sold on Telegram, automating device-code (ConsentFix) phishing to capture M365 session tokens and bypass MFA.
- Researchers detailed that Outlook auto-creates a 'tentative' meeting from the .ics file and that a soft delete or move to junk does not remove the calendar entry, enabling reminder-driven persistence.
- Cybersecurity News, GBHackers, CyberPress, Hackread, and Help Net Security reported on the M365 Groups + CalPhishing campaign and the EvilTokens kit.
- Reporting documented specific lure subjects ('Domain Renewal Failed' mimicking GoDaddy, 'Reminder for Signature - Vendor Information Verification' mimicking DocuSign) and redirect chains routed through Cloudflare to evade scanners.
- Fortra's Intelligence and Research Experts (FIRE) team published analysis of the calendar-invite phishing campaign: '.ics abuse and post-delivery persistence'.
- Threat tracked by Threadlinqs Intelligence (TL-2026-0930) as an active trusted-workflow phishing campaign with no associated CVE.
Sources cited for CalPhishing: Phishing Campaign Abusing Microsoft 365 Groups
- New Calendar Invite Phishing Campaign: ICS Abuse and Post-Delivery Persistence
- New Phishing Attack Abuses Outlook and Microsoft 365 Groups Features to Attack Users
- CalPhishing Scam Uses EvilTokens Kit, Outlook Invites to Steal M365 Sessions
- CalPhishing Campaigns Use Outlook Calendar Invites to Deliver Persistent Phishing Lures
- Hackers Abuse Outlook Groups and Microsoft 365 Collaboration Features for Phishing Attacks
- Phishing hides in routine Microsoft 365 workflows
- MITRE ATT&CK T1566: Phishing
- MITRE ATT&CK T1528: Steal Application Access Token
Threats related to CalPhishing: Phishing Campaign Abusing Microsoft 365 Groups
- Top Phishing-Kit Platforms Driving AiTM Session-Theft and MFA-Bypass Campaigns (SOCRadar, Aug 2026)
- EvilTokens Phishing-as-a-Service Kit Abuses Microsoft Device Code Authentication with AES-GCM "Ghost Code" to Breach Finance, Tech, and Managed Security Firms
- Polymorphic Phishing Page at addresses.performs.vu Regenerates Its Code on Every Load, Defeating Hash-Based Detection
- Proofpoint 2026 AI-Era Ransomware Report: 65% of Victims Report AI Increased Attack Effectiveness
- Microsoft 365 AitM Phishing Campaign Hijacks Sessions via Residential Proxies to Harvest Payroll and Finance Emails
- Phishing Campaign Impersonates LastPass and Bitwarden Security Alerts to Deliver Fake DocuSign Pages
Detection coverage for TL-2026-0930
As of 2026-06-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0930 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.