# CalPhishing: Phishing Campaign Abusing Microsoft 365 Groups and Outlook Calendar Invites for Persistent Lures and EvilTokens Device-Code Session Theft

> Fortra's Intelligence and Research Experts (FIRE) team documented an active 2026 phishing campaign that abuses legitimate Microsoft 365 Groups and Outlook calendar features rather than a software vulnerability. Attackers create attacker-controlled groups impersonating internal departments, add victims, and deliver lures through group mailboxes, shared files, and .ics calendar invites (CalPhishing) whose reminders keep the phish alive after the originating email is deleted. The chain frequently terminates in the EvilTokens device-code phishing kit, which steals Microsoft 365 session tokens and bypasses MFA.

- **Published:** 2026-06-23T00:00:00Z
- **Last reviewed:** 2026-06-23T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0930
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-calphishing-outlook-calendar-lures-tl-2026-0930.webp?v=a5c850d5 (Threadlinqs threat intel: CalPhishing Microsoft 365 Groups Invites: Detection & IOCs (TL-2026-0930) — High severity, 19 IOCs, 9 detection rules.)
- **ID:** TL-2026-0930
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 19 (1 shown free below)

## Description

Fortra's Intelligence and Research Experts (FIRE) team identified a phishing campaign, active in early-to-mid 2026, that represents a shift from traditional inbox spoofing toward abuse of trusted Microsoft 365 collaboration workflows. Because the activity runs through Microsoft's own infrastructure and services rather than a spoofed sender, it evades much of the source-validation logic that both email security gateways and phishing-awareness training rely on.

Initial access begins when a target is added to, or invited into, an attacker-created or attacker-controlled Microsoft 365 Group. Group names, descriptions, and welcome messages are crafted to blend in with internal communications and to manufacture urgency or routine context, using themes such as 'IT Support,' 'HR Updates,' 'Finance Review,' 'Leadership Briefing,' and 'All Company,' or payroll updates, contract renewals, supplier requests, mandatory training, and invoice review. A single group join simultaneously grants the attacker a foothold across the victim's group mailbox, shared file storage, and calendar surface.

The campaign's signature component is CalPhishing (Calendar Phishing). A malicious calendar event in iCalendar (.ics) format is delivered to the victim's Outlook calendar. As soon as Outlook processes the .ics file it automatically creates a 'tentative' meeting on the calendar without any user interaction, and this occurs before email security tools scan the attachment. The attacker weaponizes standard calendar fields: SUMMARY to create urgency, LOCATION to reference attached files and appear legitimate, and DESCRIPTION to carry the phishing message and instructions (links, sign-in prompts, file references). The core security gap is post-delivery persistence: a soft delete, move to junk, or remediation of the originating email does not remove the meeting entry from the calendar itself, so scheduled reminders keep resurfacing the lure. Over time the event begins to look like an unfinished work task, and recurring reminders apply sustained psychological pressure that brings the malicious content back into view long after the email is gone.

Payload delivery across the group surfaces includes credential-harvesting links and sign-in prompts, QR codes pointing to credential-harvesting pages, macro-enabled documents shared through group collaboration, fake support processes inside shared documents, and themed lures including fake Microsoft 365 / domain renewal alerts mimicking GoDaddy and fake digital-signature requests mimicking DocuSign. Rather than harvesting static passwords, the campaign frequently pivots to token theft via device-code phishing (referred to with the ConsentFix technique), allowing the attacker to capture a valid Microsoft 365 session token and authenticate as the user even when MFA is enabled. This workflow is automated by the EvilTokens phishing kit, which is sold on Telegram and packages device-code/consent phishing and session-token capture so operators can compromise accounts despite multi-factor authentication.

Reported outcomes include credential theft, session/token capture, MFA bypass via stolen application access tokens, malware delivery, broad data exposure across the network, and follow-on social engineering. Defense requires looking well beyond initial email delivery: tracing the full chain (who created the group, who was added, what files were shared, and whether calendar entries remain after mail remediation) and achieving cross-surface visibility spanning mail, calendar, files, and identity/token activity.

## MITRE ATT&CK

- T1598 Phishing for Information
- T1598.003 Spearphishing Link
- T1583.001 Domains
- T1585.003 Cloud Accounts
- T1588.002 Tool
- T1608.005 Link Target
- T1566 Phishing
- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1199 Trusted Relationship
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1528 Steal Application Access Token
- T1539 Steal Web Session Cookie
- T1187 Forced Authentication
- T1684.001 Impersonation
- T1550.001 Application Access Token
- T1114 Email Collection
- T1530 Data from Cloud Storage

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**EvilTokens — Device-Code (ConsentFix) Sign-In and Stolen-Token Replay (C2 / Account Takeover)** (`TL-2026-0930-SPL-003`)

Detects the EvilTokens device-code/ConsentFix phishing terminus: an OAuth device authorization grant (device code flow) sign-in followed by token replay from a different IP/location, indicating M365 session-token theft and MFA bypass via alternate authentication material. Flags device-code auth atypical for the user and rapid sign-in from a new IP using the issued token.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1528, T1539, T1550.001
- **Data sources:** azure:aad:signin, Microsoft Entra ID sign-in logs, Azure AD SigninLogs
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=azure sourcetype="azure:aad:signin" 
| eval authProto=coalesce('authenticationProtocol','authProtocol',"") 
| eval isDeviceCode=if(match(lower(authProto),"devicecode") OR match(lower(coalesce('originalTransferMethod',"")),"devicecode"),1,0) 
| where isDeviceCode=1 OR isDeviceCode=true 
| stats min(_time) as firstTime max(_time) as lastTime dc(ipAddress) as distinct_ips values(ipAddress) as ips values(appDisplayName) as apps values(deviceDetail.operatingSystem) as os by userPrincipalName 
| where distinct_ips >= 2 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| table firstTime lastTime userPrincipalName distinct_ips ips apps os 
| sort - distinct_ips
```

### Microsoft KQL

```kql
// Equivalent Sentinel KQL for cross-validation
SigninLogs
| where TimeGenerated > ago(24h)
| where AuthenticationProtocol == "deviceCode" or AuthenticationProcessingDetails has "deviceCode"
| summarize firstSeen=min(TimeGenerated), lastSeen=max(TimeGenerated), distinctIPs=dcount(IPAddress), ips=make_set(IPAddress, 10), apps=make_set(AppDisplayName, 10) by UserPrincipalName
| where distinctIPs >= 2
| project UserPrincipalName, firstSeen, lastSeen, distinctIPs, ips, apps
| sort by distinctIPs desc
```

### Sigma

```yaml
title: EvilTokens OAuth Device Code Sign-In and Stolen Token Replay
id: 6f1c2a90-0a3d-4b7e-9c11-0930a1b2c303
status: experimental
description: Detects an OAuth device authorization grant (device code flow) sign-in consistent with EvilTokens/ConsentFix phishing, especially when followed by token replay from a new IP (MFA bypass via stolen session token)
references:
    - https://www.fortra.com/blog/new-calendar-invite-phishing-campaign-ics-abuse-and-post-delivery-persistence
    - https://attack.mitre.org/techniques/T1528/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/06/24
tags:
    - attack.credential_access
    - attack.defense_evasion
    - attack.t1528
    - attack.t1539
    - attack.t1550.001
logsource:
    product: azure
    service: signinlogs
detection:
    selection:
        AuthenticationProtocol: 'deviceCode'
    condition: selection
fields:
    - UserPrincipalName
    - IPAddress
    - AppDisplayName
falsepositives:
    - Legitimate device-code sign-ins from IoT/CLI tooling (Azure CLI, PowerShell device login)
level: high
```

**Known false positives:**

- Legitimate device-code sign-ins from Azure CLI / PowerShell device login
- IoT or smart-TV style app enrollment using device code flow

**Tuning notes:** Allowlist app IDs and service accounts that legitimately use the device code flow (Azure CLI, Visual Studio Code, kiosk enrollment). Escalate to critical when device-code auth is followed within minutes by a sign-in from a new ASN/country using the same session. Pair with Conditional Access token-protection alerts.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- CalPhishing — External M365 Group Add and Auto-Tentative Calendar Creation (Exploitation) (locked: unlock with TL Creds)
- CalPhishing — Weaponized .ics Fields and Reminder Persistence After Mail Remediation (Post-Exploitation) (locked: unlock with TL Creds)
- EvilTokens — Device-Code Phishing Followed by Token Replay From New IP (C2 / MFA Bypass) (locked: unlock with TL Creds)
- CalPhishing — Inbound External .ics Auto-Tentative Meeting (Exploitation, Sigma-primary) (locked: unlock with TL Creds)
- CalPhishing — Department-Themed External Group Add Granting Cross-Surface Footprint (Post-Exploitation, Sigma-primary) (locked: unlock with TL Creds)
- EvilTokens — OAuth Device Code Grant / Consent Phishing Sign-In (C2, Sigma-primary) (locked: unlock with TL Creds)
- CalPhishing — Inbound .ics Auto-Creates Tentative Meeting from External M365 Group (Exploitation) (locked: unlock with TL Creds)
- CalPhishing — Calendar Item Persists After Originating Mail Remediation (Post-Exploitation Persistence) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 19)

Defanged, TLP:CLEAR.

- Domain: `groups[.]outlook[.]com`

Full set of 19 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [New Calendar Invite Phishing Campaign: ICS Abuse and Post-Delivery Persistence](https://www.fortra.com/blog/new-calendar-invite-phishing-campaign-ics-abuse-and-post-delivery-persistence)
- [New Phishing Attack Abuses Outlook and Microsoft 365 Groups Features to Attack Users](https://cybersecuritynews.com/new-phishing-attack-abuses-outlook-and-microsoft-365-groups/)
- [CalPhishing Scam Uses EvilTokens Kit, Outlook Invites to Steal M365 Sessions](https://hackread.com/calphishing-eviltokens-kit-outlook-invites-m365/)
- [CalPhishing Campaigns Use Outlook Calendar Invites to Deliver Persistent Phishing Lures](https://gbhackers.com/calphishing-campaigns-use-outlook-calendar/)
- [Hackers Abuse Outlook Groups and Microsoft 365 Collaboration Features for Phishing Attacks](https://cyberpress.org/outlook-groups-fuel-phishing/)
- [Phishing hides in routine Microsoft 365 workflows](https://www.helpnetsecurity.com/2026/06/23/microsoft-365-collaboration-features-phishing/)
- [MITRE ATT&CK T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
- [MITRE ATT&CK T1528: Steal Application Access Token](https://attack.mitre.org/techniques/T1528/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0930