# Fake Calendar Invite (.ics / Teams Meeting) Microsoft Credential Phishing Campaign Targeting 40,000+ Organizations

> Large-scale credential phishing campaign delivering fake calendar invitations (.ics attachments and fraudulent Teams meeting 'Join' links) that lead victims to a fake Microsoft sign-in page to harvest account credentials. Check Point detected 302,386 unique emails from 247,270 sender addresses across 33,890 domains aimed at 40,000+ organizations, surging from 118,000 emails in September to 740,000 in the first two weeks of October 2026.

- **Published:** 2026-10-24T14:39:46Z
- **Last reviewed:** 2026-10-24T14:39:46Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4399
- **ID:** TL-2026-4399
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 6 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Check Point Email Research reported (blog published 2026-10-15) several large-scale phishing campaigns that abuse the routine exchange of calendar invitations to harvest Microsoft account credentials. Detection volume was a few thousand emails per month in April 2026, spiked from 2026-09-25, reached more than 118,000 emails in September and more than 740,000 in the first two weeks of October, with a peak of nearly 200,000 emails on 2026-10-08. Check Point counted 302,386 unique phishing emails (average 8,319 per active day) sent from 247,270+ sender addresses on 33,890+ domains to 40,000+ organizations. Sustained activity was still observed as late as 2026-10-15. Truesec republished the analysis on 2026-10-21.

Two delivery variants are documented. Variant 1 is a fake calendar invite carrying a malicious .ics attachment: valid calendar data that abuses the format and user trust rather than any software flaw, so the file type itself is harmless to filters and the invite can open normally or add the meeting to the recipient's calendar, making it look genuine. Variant 2 is a fake Microsoft Teams meeting invite whose 'Join' link, when hovered, reveals a credential-harvesting page at login.microsoft.com rather than Teams. Invites use meeting title, date, attendee list and Microsoft branding. Secondary reporting states the event description, location field or an embedded QR code may carry the link to a fake Microsoft 365 sign-in page (or a fraudulent payment portal), and that the page records the username and password entered.

Calendar artifacts can remain in the user's calendar after the originating email is blocked (Check Point Harmony Email & Collaboration added automatic removal of such invitations in March 2026), so remediation must cover both messages and calendar events. The sources do not publish phishing URLs, hashes, subject lines or IPs, do not name a malware family, and make no attribution; those fields are therefore unknown. Note: login.microsoft.com is named by the sources as the lure destination, but it is also a legitimate Microsoft-owned hostname; defenders should analyse the actual href and redirect chain of each sample rather than blocking that hostname outright.

## MITRE ATT&CK

- T1566 Phishing
- T1566.001 Phishing: Spearphishing Attachment
- T1566.002 Phishing: Spearphishing Link
- T1204.001 User Execution: Malicious Link
- T1204.002 User Execution: Malicious File
- T1036 Masquerading
- T1684.001 Impersonation

## Sources

- [Fake Calendar Invites Target Thousands of Organizations in Microsoft Credential-Phishing Campaign (Check Point)](https://blog.checkpoint.com/securing-user-and-access/fake-calendar-invites-target-thousands-of-organizations-in-microsoft-credential-phishing-campaign/)
- [Fake calendar invites in Microsoft credential phishing campaign (Truesec)](https://www.truesec.com/hub/blog/fake-calendar-invites-in-microsoft-credential-phishing-campaign)
- [Microsoft 365 Calendar Phishing Targets 40,000 Organizations (eSecurityPlanet)](https://www.esecurityplanet.com/cybersecurity-threats/news-microsoft-365-calendar-invite-phishing-campaign/)
- [Fake Calendar Invites Target 40,000 Firms in Microsoft Credential Theft (Hackread)](https://hackread.com/fake-calendar-invites-firms-microsoft-credential-theft/)
- [Fake calendar invites hit thousands of businesses in Microsoft credential phishing campaign (TechRadar)](https://techradar.com/pro/security/fake-calendar-invites-hit-thousands-of-businesses-in-microsoft-credential-phishing-campaign)
- [Quarantined, but still on your calendar: The explosion of invite-based attacks (Help Net Security)](https://www.helpnetsecurity.com/2026/10/20/malicious-calendar-invites/)
- [Enhanced Protection for Calendar-Based Attacks in Microsoft 365 Emails (Check Point)](https://blog.checkpoint.com/product-updates/enhanced-protection-for-calendar-based-attacks-in-microsoft-365-emails/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4399