Topic starter
24/10/2026 8:49 pm
TL;DR: Malicious calendar invites can slip past inbox defences because .ics files are auto-added to calendars, according to Hoxhunt. That leaves a persistent phishing path that combines user curiosity with a control gap between email and calendar remediation.
Editorial analysis by NHI Mgmt Group, based on content published by Hoxhunt: “The Rise of Calendar-Invite Phishing: When a Meeting Invite Isn’t Really a Meeting”.
Key questions
Q: What breaks when malicious calendar invites are only handled as email threats?
A: The attack window stays open because the calendar item can survive after the email is removed.
Q: Why do calendar invites increase phishing risk even after users report the email?
A: Because the control workflow usually focuses on the email object, not the calendar object.
A: Security teams should treat calendar invites as a trusted but high-risk delivery channel and inspect attachment behavior, sender authenticity, and message intent together.
Practitioner guidance
- Implement calendar-aware phishing remediation Verify that your phishing response removes the associated calendar entry as well as the email, and test the workflow with malicious .ics samples.
- Review external invite handling policies Assess whether automatic processing of external calendar invites should remain enabled for all mailboxes, then scope exceptions for high-risk groups or tenants.
- Filter malicious .ics invites carefully Use mail flow rules or quarantine logic for external .ics files only where the business impact is understood, and allowlist trusted sender domains where needed.
Bottom line: Calendar invite phishing exploits a mismatch between message handling and calendar object handling, so the malicious artefact can survive inbox cleanup.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/10/2026 11:13 am
Calendar objects are now part of the phishing attack surface, not just email. When .ics processing auto-creates an event, the security boundary moves from inbox filtering to collaboration-object governance. That matters because many organisations still measure phishing response by message removal, even though the risky artefact can survive in the calendar. The practical conclusion is that email security and collaboration security must be managed as one control domain.
A few things that frame the scale:
- The IBM/Ponemon 2025 Cost of a Data Breach Report found that phishing-initiated breaches cost an average of $4.8M each.
A question worth separating out:
Q: Should organisations disable automatic processing of external meeting requests?
A: Not universally. Disabling automatic processing reduces silent event creation, but it also creates friction for legitimate collaboration. Most organisations should target the setting by mailbox group, risk profile, or business unit, then validate that users can still schedule effectively without losing security oversight.
👉 Read our full editorial: Calendar invite phishing exposes a gap in mail-focused defences