Meeting phishing is a social engineering attack that uses fake or hijacked calendar invites, video calls, or meeting links to trick people into revealing credentials or approving access. It often exploits trusted collaboration tools and can lead to credential theft, malware delivery, or unauthorised access through shared links and prompts.
How meeting phishing works
Meeting phishing weaponises the trust people place in calendar invites, meeting reminders, and collaboration platforms. The lure may look like a routine call request, but the real objective is to get the target to approve something unsafe, hand over a secret, or follow a link into a credential-stealing flow.
This attack style matters because the interaction feels familiar and low-friction. If the message appears to come from a known colleague, vendor, or internal system, the target may respond before they verify the source, which is why Social Engineering Guide is useful background for the trust, urgency, and authority cues that make these lures work.
Common delivery patterns
Meeting phishing typically arrives through calendar systems, chat platforms, email invitations, or direct messages that reference a real event, a sudden schedule change, or an urgent request to join a call. Some variants use hijacked accounts so the invite is sent from a legitimate sender, while others rely on lookalike meeting links, fake conferencing pages, or prompts that mimic a standard sign-in step.
Because the channel is often a trusted collaboration tool, the message can bypass the suspicion people would apply to a random email. That makes the lure especially effective when it is timed around busy periods, executive meetings, finance reviews, or support requests where a fast response seems normal.
Why meeting phishing is dangerous
The main danger is not the meeting itself, but the follow-on action it provokes. A target may reveal credentials, approve an unexpected authentication prompt, grant consent to an app, or open a file or link that delivers malware or session theft. Once the attacker has that foothold, they can move from social engineering into account compromise, mailbox access, or further internal impersonation.
Meeting phishing is especially effective when users are conditioned to trust shared links and inline prompts. A single successful lure can expose not just a password, but the broader authentication path behind the account, including sessions, tokens, and connected services.
Defensive controls and user verification
Defence depends on both platform controls and human verification. Organisations should reduce blind trust in meeting links, require out-of-band confirmation for unusual invites, and make sure collaboration tools are configured to surface sender identity, external participants, and suspicious join requests clearly. Stronger sign-in methods also help by making stolen passwords less useful.
For practical control guidance, NIST SP 800-63 Digital Identity Guidelines is relevant because it sets the baseline for stronger, phishing-resistant authentication. The broader control lens in NIST SP 800-53 Rev 5 Security and Privacy Controls also maps well to identity verification, access control, logging, and configuration hardening around collaboration tooling.
Risk and Threat Considerations
Meeting phishing creates a high-consequence blend of social engineering and identity abuse because it reaches users in a trusted workflow and often exploits an existing collaboration account or service path. The risk is not limited to one stolen credential, because the same lure can lead to session theft, consent abuse, or malware delivery through a link the user believes is routine.
Failure mechanism: An attacker impersonates or compromises a trusted meeting source, then uses urgency or familiarity to push the target into entering credentials, approving access, or opening a malicious meeting artefact.
Impact: The result can be account takeover, unauthorized access to messages or files, secondary phishing from the compromised account, and a wider incident if the attacker uses the trusted channel to reach other users.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-63 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | Digital Identity Guidelines | Meeting phishing targets sign-in and approval flows that 800-63 is designed to harden. |
| Recommendation — Adopt phishing-resistant authentication to reduce the value of stolen meeting credentials. | ||
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Meeting phishing commonly abuses employee sign-in and approval paths. |
| AU-2 — Event Logging | Suspicious invite joins and approval events need traceable audit records. | |
| AC-6 — Least Privilege | Phishing impact rises when a stolen account can approve broad access or reach many systems. | |
| Recommendation — Require strong organizational-user authentication for collaboration and meeting access. Log collaboration sign-ins, invite actions, and consent events for investigation. Limit account privileges so a compromised meeting account exposes less access. | ||
Practitioner Guidance
What to watch for: Treat unexpected meeting requests, last-minute reschedules, and join links that demand sign-in as verification events, not routine admin noise. If a meeting asks for consent, credential entry, or a reauthentication step that is unusual for the context, verify it through a separate channel before proceeding.
Governance implication: Collaboration tooling needs ownership just like email and endpoint security do. Security teams should define who can configure invite behaviour, who can review suspicious account activity, and how users report a suspected meeting lure so the response is fast enough to interrupt the attack chain.
Related resources from NHI Mgmt Group
- Guide: Phishing Guide
- What is phishing-resistant authentication and how does it relate to NHI security?
- How should security teams respond to voice phishing that targets Okta accounts?
- Why do MFA and password resets fail to stop consent phishing?
- What is the difference between credential phishing and consent phishing?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 29, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org