Threat reportPhishingTL-2026-4399
Fake Calendar Invite (.ics / Teams Meeting) Microsoft Credential Phishing Campaign Targeting 40,000+ Organizations
Fake Calendar Invite (.ics / Teams Meeting) Microsoft (TL-2026-4399) is a high-severity phishing campaign, first published 2026-10-24. It has no confirmed attribution, affects Microsoft Microsoft 365 (Outlook calendar, Teams meeting invitations, maps to 7 MITRE ATT&CK techniques (T1036, T1204.001, T1204.002), and is covered by 9 detection rules and 6 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 7MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 6Indicators of compromise
Key facts for TL-2026-4399
- Threat ID
- TL-2026-4399
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- cross-sector, enterprise, finance
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 6
How Fake Calendar Invite (.ics / Teams Meeting) Microsoft works
Large-scale credential phishing campaign delivering fake calendar invitations (.ics attachments and fraudulent Teams meeting 'Join' links) that lead victims to a fake Microsoft sign-in page to harvest account credentials. Check Point detected 302,386 unique emails from 247,270 sender addresses across 33,890 domains aimed at 40,000+ organizations, surging from 118,000 emails in September to 740,000 in the first two weeks of October 2026.
Check Point Email Research reported (blog published 2026-10-15) several large-scale phishing campaigns that abuse the routine exchange of calendar invitations to harvest Microsoft account credentials. Detection volume was a few thousand emails per month in April 2026, spiked from 2026-09-25, reached more than 118,000 emails in September and more than 740,000 in the first two weeks of October, with a peak of nearly 200,000 emails on 2026-10-08. Check Point counted 302,386 unique phishing emails (average 8,319 per active day) sent from 247,270+ sender addresses on 33,890+ domains to 40,000+ organizations. Sustained activity was still observed as late as 2026-10-15. Truesec republished the analysis on 2026-10-21.
Two delivery variants are documented. Variant 1 is a fake calendar invite carrying a malicious .ics attachment: valid calendar data that abuses the format and user trust rather than any software flaw, so the file type itself is harmless to filters and the invite can open normally or add the meeting to the recipient's calendar, making it look genuine. Variant 2 is a fake Microsoft Teams meeting invite whose 'Join' link, when hovered, reveals a credential-harvesting page at login.microsoft.com rather than Teams. Invites use meeting title, date, attendee list and Microsoft branding. Secondary reporting states the event description, location field or an embedded QR code may carry the link to a fake Microsoft 365 sign-in page (or a fraudulent payment portal), and that the page records the username and password entered.
Calendar artifacts can remain in the user's calendar after the originating email is blocked (Check Point Harmony Email & Collaboration added automatic removal of such invitations in March 2026), so remediation must cover both messages and calendar events. The sources do not publish phishing URLs, hashes, subject lines or IPs, do not name a malware family, and make no attribution; those fields are therefore unknown. Note: login.microsoft.com is named by the sources as the lure destination, but it is also a legitimate Microsoft-owned hostname; defenders should analyse the actual href and redirect chain of each sample rather than blocking that hostname outright.
MITRE ATT&CK techniques used in TL-2026-4399
Defense Evasion
T1036 Masquerading; T1684.001 Impersonation
Execution
T1204.001 User Execution: Malicious Link; T1204.002 User Execution: Malicious File
Initial Access
T1566 Phishing; T1566.001 Phishing: Spearphishing Attachment; T1566.002 Phishing: Spearphishing Link
Affected products and versions in Fake Calendar Invite (.ics / Teams Meeting) Microsoft
- Microsoft — Microsoft 365 (Outlook calendar, Teams meeting invitations, Entra ID/Microsoft account sign-in)
Vulnerable versions: All (social-engineering abuse; no software vulnerability)
Remediation for Fake Calendar Invite (.ics / Teams Meeting) Microsoft
Immediate actions
- Search mail and calendar logs for .ics attachments and Teams-style invites from external, first-seen senders since 2026-09-25 and purge both the messages and the resulting calendar events
- Force password reset and revoke active sessions/refresh tokens for any user who clicked a Join link or entered credentials; audit mailbox rules and OAuth consents on those accounts
- Report compromised credentials to the security team immediately
- Analyse the real destination of calendar-invite links (href mismatch) before allow/deny decisions, since the sources cite login.microsoft.com as the lure host
Workarounds
- Review/disable automatic processing of external calendar invitations in Exchange Online/Outlook
- Inspect .ics content for embedded URLs and flag newly registered sender domains with mismatched links
Longer-term hardening
- Deploy phishing-resistant MFA (passkeys, FIDO2 hardware keys)
- Add calendar-invite lures (.ics and fake Teams meetings) to security awareness training
- Monitor Entra ID sign-in logs for suspicious sign-ins and anomalous locations
- Enable calendar-artifact auto-removal in the email security stack when a related email is quarantined
Timeline of Fake Calendar Invite (.ics / Teams Meeting) Microsoft
- Check Point Harmony Email & Collaboration adds automatic removal of malicious calendar invitations when the associated phishing email is blocked (calendar artifacts otherwise persist after email quarantine)
- Calendar-invite phishing detected at low volume: a few thousand emails per month (April 2026)
- Check Point observes a sharp surge in fake calendar-invite phishing emails (.ics attachments and fake Teams meeting links)
- September 2026 volume reaches more than 118,000 emails
- Peak day of the campaign with nearly 200,000 emails in a single day
- Check Point publishes research: 302,386 unique emails, 247,270 sender addresses, 33,890 domains, 40,000+ organizations; 740,000+ emails in first two weeks of October; activity still ongoing
- Help Net Security reports on the explosion of invite-based attacks and calendar artifacts persisting after quarantine
- Truesec publishes advisory with mitigation guidance (out-of-band verification, URL checks, phishing-resistant MFA, sign-in monitoring)
Sources cited for Fake Calendar Invite (.ics / Teams Meeting) Microsoft
- Fake Calendar Invites Target Thousands of Organizations in Microsoft Credential-Phishing Campaign (Check Point)
- Fake calendar invites in Microsoft credential phishing campaign (Truesec)
- Microsoft 365 Calendar Phishing Targets 40,000 Organizations (eSecurityPlanet)
- Fake Calendar Invites Target 40,000 Firms in Microsoft Credential Theft (Hackread)
- Fake calendar invites hit thousands of businesses in Microsoft credential phishing campaign (TechRadar)
- Quarantined, but still on your calendar: The explosion of invite-based attacks (Help Net Security)
- Enhanced Protection for Calendar-Based Attacks in Microsoft 365 Emails (Check Point)
Detection coverage for TL-2026-4399
As of 2026-10-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4399 across Splunk SPL, Microsoft KQL and Sigma, covering 6 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.