A new wave of calendar-based phishing invites is infiltrating work and personal calendars, fooling users into revealing login details or paying bogus charges.
A new calendar phishing scam is making its rounds, showing up as fake meetings or renewal notices in calendars like Google Calendar. The fake invites can be added automatically, so you don’t even need to open a dangerous email to become a target.
What this means for you is simple: treat unexpected invites with caution. Turn off automatic accepting and don’t click any links in suspicious invites. If something looks off, delete it or mark it as spam.
When in doubt, check with the supposed sender through a separate channel and enable stronger security settings across your calendar and email. This trend is likely to continue, so staying vigilant is your best defense.
The calendar phishing scam is spreading, with more people finding unexpected invites in their Google and other calendar apps. The attack looks like a real meeting, a renewal notice, or a warning about a charge, and it pushes users to click a link or call a number to log in or cancel something that doesn’t exist.
Security researchers describe calendar phishing as a growing threat because calendar apps can add invitations automatically, even if you didn’t open the original email. That borrowed credibility makes the scam harder to spot and harder to block with standard filters.
What’s happening here is not a new computer breach, but a social engineering trick: scammers rely on the calendar’s normal role in our days to convince you a notification comes from a trusted source. They may use a fake Zoom invitation or a calendar entry that looks like a routine event to coax you into handing over credentials or paying a bogus charge.
If you use a calendar app for work or personal life, you’re a target. The attack doesn’t require you to click an email first; it can appear in your calendar as an auto-added event. That’s why experts say you should treat any unsolicited invite with caution, even if it looks familiar or comes from someone you know.
Two simple protections can cut your risk. First, turn off automatic accepting of invitations. In Google Calendar, you can choose settings to only accept invitations from known senders or after you’ve reviewed them. Second, don’t click any links or call numbers in suspicious invites. If an invite seems odd, delete it or mark it as spam instead of replying.
Look for invites that arrive out of the blue and push you to log in or reveal credentials. The event description often contains a link or a phone number. Scammers may use legitimate platforms to appear more credible, which can complicate filtering. If something asks you to login via a fake page or to cancel a charge that you don’t recognize, that’s a red flag.
If you think you’ve clicked a link or entered credentials, act quickly. Change passwords for the affected accounts, enable two-factor authentication, and review recent activity. Report suspicious invites as junk or spam in your calendar app, and consider tightening security settings across your calendar and email accounts.
Security teams expect calendar phishing to remain a popular tactic because it leverages a routine tool in daily life. Users who adopt strict invitation controls and stay wary of unexpected requests will be less likely to fall for it. The best defense is prevention, not reaction, so update settings now and share these tips with coworkers and family.
A phishing tactic that hides in calendar invitations and prompts users to log in or pay bogus charges, often added automatically by the calendar app.
Turn off automatic accepting in your calendar app, verify invites from known senders, and avoid clicking links or calling numbers in suspicious invitations.
You're reading the quick version.
A Tenable Field CTO argues labeling AI agents as rogue misplaces blame and delays practical safety rules and regulation.
Apple’s iOS 27 adds Time Allowances, Ask to Browse, Pause Device and more, aiming to help families manage screen time and safety across devices.
A new generation of TCL Google TV sets can collect data through automatic content recognition. Here’s how to disable it and tighten privacy.
The Daily Brief
Every morning, the news that matters from AI, phones, apps and the people shaping tech. Explained in plain English. Free.
One email a day. No spam, unsubscribe anytime. Privacy policy
