Fake Calendar Invites: Stop Microsoft 365 Phishing Before the Next Meeting

Why meeting invitations deserve a second look

Check Point’s 15 October 2026 research describes credential-phishing campaigns using fake calendar invitations, including valid ICS calendar files and misleading meeting links. The mechanism abuses trust in a familiar workflow; a valid calendar format is not proof of a legitimate meeting. This is observed campaign activity, not evidence that every recipient or organization was compromised.

Use a verification habit that works on a phone

Imagine an unexpected invitation about an overdue invoice. The safest first step is to open your usual calendar or collaboration app directly. Check whether the organizer is someone you were already expecting to meet. Contact that person through a saved number or an existing conversation, rather than replying to contact details supplied in the invitation. A familiar display name or company logo should not settle the decision.

On a small screen, the visible link label is particularly easy to mistake for its destination. Avoid testing suspicious links by opening them. Send the item to the organization’s security reporting route and let the authorized team inspect it. If you need to join a real meeting, obtain a fresh invitation from the verified organizer.

Give staff a short reporting procedure

1. Keep the original message or calendar item available for the security team. Record the received time and the account involved.
2. Report it through the approved mail-client reporting control or help desk. The exact control differs between Outlook versions and tenant policies.
3. Ask the team how to remove the event safely. Do not forward the active invitation to colleagues as a warning.
4. If you opened the link, say whether you only viewed it, entered a password, approved MFA, downloaded a file or granted application consent. Those are different investigation paths.

When someone has already signed in

Use a trusted device and the known Microsoft administration portal. Microsoft’s compromised-account guidance covers regaining account control and investigating related activity. An authorized administrator should assess session revocation, credentials, authentication methods, mailbox forwarding and inbox rules, alongside sign-in evidence. Changing a password alone is not a complete investigation. Check for messages sent to customers or internal staff and assign someone to handle follow-up communication.

Turn the incident into a useful exercise

Run a short tabletop exercise using a harmless screenshot rather than a live phishing page. Ask three questions: where would a staff member verify the organizer, how would they report the item, and who can respond after hours? Measure time to report, not how embarrassed someone feels. A small team needs a contact route that works when the main administrator is unavailable.

Add layered protection

Review external-calendar handling and mail protection with your administrator, testing legitimate bookings before enforcing a broad restriction. Pair staff training with phishing-resistant sign-in planning. Our SPF, DKIM and DMARC guide helps protect your sending domain, but domain authentication alone does not prove an invitation is safe. For a coordinated review, ask about business IT support.