Topic starter
11/11/2026 6:05 pm
TL;DR: ICS files are now a durable phishing delivery path, according to Netcraft’s telemetry and case work, because calendar workflows can carry a lure past inbox controls and keep it visible after deletion. Calendar trust and default invite handling now matter as much as email filtering for prevention.
Editorial analysis by NHI Mgmt Group, based on content published by Netcraft: “Youâre Invited: How Attackers Get into Your Calendar the Easy Way”.
Key questions
Q: Why do calendar invites let attackers keep a phishing lure visible after deletion?
A: Calendar invites can stay visible because many mail and calendar clients cache event data separately from the original message, so deleting the email does not always remove the calendar entry.
Q: How do ICS files work as a phishing delivery mechanism?
A: ICS files are iCalendar event files that define meeting data such as time, organiser, attendees and links, and email systems often treat them as legitimate calendar invites.
Q: How should security teams handle phishing messages that create calendar invites?
A: They should treat the calendar event as a security object, not just the email that created it.
Practitioner guidance
- Restrict automatic external invite ingestion Disable or narrow default processing for calendar invites from outside the organisation where users do not need that behaviour, and require explicit review before events are added.
- Tune phishing guidance for calendar-based lures Update user guidance so staff know that legitimate-looking meetings, alerts, and voicemail notices can arrive through ICS files rather than email body links.
- Review device code authentication training Teach users that any device code prompt reached from a calendar invite should be treated as suspicious unless it is independently verified through a known workflow.
Bottom line: Calendar invite phishing succeeds because client workflows can turn a non-executable ICS file into a trusted-looking event.
Glossary terms: Phishing, ICS File, Device code phishing, Calendar-based Phishing
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:07 pm
ICS phishing works because mailbox security stops too early: the control boundary is often built around email delivery, but the lure’s meaningful moment happens when a calendar client renders the invite. That shifts the attack from a message-scanning problem to a workflow-trust problem. Organisations that only harden inbox filters will keep missing the point, because the calendar application becomes part of the attack path.
A question worth separating out:
Q: Where should organisations set the boundary between email filtering and calendar trust?
A: Organisations should treat email filtering as the control for message delivery and malware screening, while calendar trust should be governed by separate client and collaboration controls for invite acceptance, external organiser handling and automatic event creation. A malicious invite can bypass the inbox yet still place a link or attachment into the calendar, so the boundary needs explicit policy and logging.
👉 Read our full editorial: Calendar invite phishing bypasses filters and lingers in calendars