Topic starter
27/06/2026 1:56 pm
TL;DR: Attackers are hiding phishing payloads inside Outlook calendar invites and Teams-style meeting requests, including .ics attachments and raw EML code that can create events without visible cues, according to Abnormal AI. The core issue is that mail authentication can succeed while calendar trust assumptions still fail, leaving Microsoft 365 access and user attention exposed.
Editorial analysis by NHI Mgmt Group, based on content published by Abnormal AI: “Introducing Calendar Invite Remediation for Malicious Outlook Events”.
Key questions
Q: What breaks when Outlook creates calendar invites from hidden phishing content?
A: The failure is that users can receive a calendar object that looks operationally normal even when the underlying message was malicious.
Q: Why do SPF, DKIM, and DMARC not stop this kind of phishing?
A: They validate message authenticity signals, but they do not prove the communication is safe or legitimate in context.
Q: How should security teams handle OAuth consent risk in Microsoft 365?
A: Treat user-consented application grants as persistent access, not as a one-time sign-in event.
Practitioner guidance
- Tighten calendar object controls Review how Outlook and Microsoft 365 create events from .ics attachments and embedded invite data, then decide which message patterns should be blocked, quarantined, or remediated before event creation.
- Separate sender trust from content trust Do not treat SPF, DKIM, and DMARC pass results as a safe-content verdict.
- Govern OAuth consent more tightly Restrict unreviewed app consent, monitor delegated permission grants, and challenge any flow that requests persistent Microsoft 365 access through a browser redirect or external app.
Bottom line: Calendar invite phishing turns an ordinary scheduling feature into a persistence and trust problem for Microsoft 365 environments.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/06/2026 3:27 pm
Calendar trust has become an identity control surface. Outlook-generated events are not a cosmetic side effect of mail delivery. They are an enforcement point where message content can become a persistent user-facing object, which means collaboration tooling now sits inside the identity attack path. Practitioners should treat calendar creation rules as part of access governance, not just mail hygiene.
A few things that frame the scale:
- The average time to mitigate a leaked secret is 36 hours, highlighting the operational burden of manual remediation processes, according to the 2024 State of Secrets Management Survey.
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to the State of Secrets in AppSec.
A question worth separating out:
Q: How should organisations respond when a phishing email has already created a calendar event?
A: They should remove the malicious event, preserve legitimate meetings, and confirm whether the same message triggered a consent flow or any other delegated access grant. The response must cover both the inbox artefact and the calendar artefact, because cleanup that stops at email leaves the user-facing lure in place.
👉 Read our full editorial: Calendar invite phishing exposes Outlook’s trust gap in Microsoft 365