Calendar invite phishing: are your controls keeping up?

TL;DR: Malicious calendar invites can slip past inbox defences because .ics files are auto-added to calendars, according to Hoxhunt. That leaves a persistent phishing path that combines user curiosity with a control gap between email and calendar remediation.

Editorial analysis by NHI Mgmt Group, based on content published by Hoxhunt: “The Rise of Calendar-Invite Phishing: When a Meeting Invite Isn’t Really a Meeting”.

Key questions

Q: What breaks when malicious calendar invites are only handled as email threats?

A: The attack window stays open because the calendar item can survive after the email is removed.

Q: Why do calendar invites increase phishing risk even after users report the email?

A: Because the control workflow usually focuses on the email object, not the calendar object.

Q: How should security teams reduce the risk of malicious calendar invite attachments without blocking legitimate meeting invites?

A: Security teams should treat calendar invites as a trusted but high-risk delivery channel and inspect attachment behavior, sender authenticity, and message intent together.

Practitioner guidance

• Implement calendar-aware phishing remediation Verify that your phishing response removes the associated calendar entry as well as the email, and test the workflow with malicious .ics samples.
• Review external invite handling policies Assess whether automatic processing of external calendar invites should remain enabled for all mailboxes, then scope exceptions for high-risk groups or tenants.
• Filter malicious .ics invites carefully Use mail flow rules or quarantine logic for external .ics files only where the business impact is understood, and allowlist trusted sender domains where needed.

Bottom line: Calendar invite phishing exploits a mismatch between message handling and calendar object handling, so the malicious artefact can survive inbox cleanup.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →