Cybersecurity briefing
/
The Phishing Email Is Gone but the Calendar Invite Remains
Removing a phishing email can leave its malicious calendar invite behind. Why email response must follow ICS invitations into the calendar.
/
AUTHOR
Jeff Dyer
/
SHARE THIS ARTICLE
Overview
A malicious meeting invitation can remain on an employee's calendar after security tools remove its email. Business Insider's October 12 reporting examined how attackers use workplace scheduling to deliver credential theft, fraudulent requests and malware. The response can fail when it stops at the inbox.
An unfamiliar invitation sits among customer calls, interviews and internal meetings, sometimes accompanied by reminders. That placement can suggest the meeting has already been accepted or vetted. Deleting the original message may leave both the malicious link and its apparent legitimacy intact.
A meeting request creates another place to click
Calendar invitations commonly carry iCalendar, or ICS, data that applications use to create events. Depending on the service and its settings, an invitation can appear on a recipient's calendar without explicit acceptance. The attack then exists in two places.
Sublime Security's September 17 research reported a 1,216% increase in observed calendar attacks in August over July. The figure describes the company's observations, rather than every organization's exposure.
A successful email-removal count can conceal the remaining risk. If the event survives, the employee may encounter its link later while preparing for what looks like a scheduled meeting. Incident closure needs to account for that second opportunity to click.
Legitimate infrastructure can carry an illegitimate request
One attack in Sublime's research used a Google Calendar invitation with a financial lure. A link led to a page on Framer's hosting service and then to a ScreenConnect installer configured for the attack. ScreenConnect is legitimate remote-management software; the danger was the installation being induced and the access it would provide.
Microsoft's July 23 threat research described a June campaign that paired a calendar invitation with a nested email attachment. A link inside that message passed through Microsoft's authentication infrastructure before redirecting to a Windows batch file hosted on ClickUp's attachment service.
In both cases, recognized services carried an illegitimate request. Investigators need to follow the destination and the action being requested, whether entering credentials, authorizing access or running software. A familiar domain at the start of the chain says little about what happens at the end.
Response has to follow the invitation into the calendar
AI-powered email security platforms combine message analysis with automated investigation and response. Sublime Security, one platform in this category, examines invitation attachments and links alongside sender and organizational context. Its documented ICS protection connects mailbox remediation to calendar cleanup: moving a message to quarantine, spam or trash can also delete its corresponding events.
That workflow requires calendar access for Microsoft 365 and Google Workspace. Sublime's implementation documentation also notes that some Google configurations permit invitations without an accompanying email. Organizations therefore need to test the invitation paths covered by message-associated removal and address other paths through calendar settings.
The test should establish whether an event was created and whether remediation removed it from the recipient's calendar. A successful mailbox action or API response alone does not establish that the employee can no longer reach the invitation.
Reversing a mistaken verdict introduces another dependency. Restoring the message creates a placeholder event pointing back to the original invitation, according to the same documentation. It does not reconstruct the original meeting. Support teams need to understand that behavior when helping users recover legitimate invitations.
Restricting invitations has a business cost
Google's invitation settings allow events to be added from everyone, only known senders, or only after the recipient responds by email. Administrators can restrict the available choices, and changes apply to new invitations.
Those choices affect work differently across an organization. Recruiters and account executives routinely meet new contacts. Internal operations teams may have little need for unsolicited invitations. A uniform policy can leave unnecessary exposure in one department while disrupting legitimate scheduling in another.
Known-sender status is not a security verdict. A familiar contact can send an unexpected request, and a new contact can be legitimate. Invitation policies need to reduce automatic exposure without making employees bypass the intended process to arrange ordinary meetings.
Integralty's assessment of Microsoft 365 or Google Workspace controls can examine those tradeoffs alongside email protection and incident procedures. The review should establish how invitations arrive, which controls act on them, and how administrators recover legitimate meetings caught by the policy.
Verify that the invitation is no longer accessible
Start with a harmless test invitation containing a controlled link. Observe its appearance in the inbox and calendar, apply the expected security action, and inspect both places afterward. Repeat the exercise for an invitation discovered through later threat hunting and for a legitimate message restored after a mistaken verdict.
Retain evidence connecting the message, recipient, event and removal action. Measure how long the invitation remains accessible after detection, rather than relying solely on message-removal totals. If the employee already clicked or installed software, cleanup must be followed by investigation of the resulting activity.
Calendar phishing exposes a gap between identifying a threat and removing the employee's exposure to it. Closing that gap requires controls that follow the invitation across applications and evidence that the cleanup reached every covered destination.
/
BLOG
