More Than 40 000 Organizations Have Received Fake Calendar Invites in Microsoft Credential-Phishing Campaign

One campaign method is to attach a malicious .ics file to a fake calendar invite. Another is to send a fake Teams meeting invite whose “Join” link leads to a phishing site at login.microsoft.com, users can reveal the actual URL by hovering over the link. The phishing site is used to harvest credentials. More than 40,000 organizations have received these emails.

The threat actors have been observed to use more than 33,890 unique sender domains and more than 247,270 different sender addresses.

The research also describes a steep rise in monthly email volume, from a few thousand emails in April to more than 118,000 emails in September, followed by more than 740,000 in the first two weeks of October. The busiest recorded day was 8 October, when nearly 200,000 emails were sent. [1]

Recommendations

These campaigns are successful because meeting invitations are a normal part of the workday, and employees often accept them without questioning whether they are legitimate.

Calendar invitations should be treated as another potential phishing channel, and organizations need to raise user awareness of ongoing campaigns that use fake .ics attachments and fraudulent Teams meetings.

• Verify unexpected invitations. Confirm unfamiliar senders or unusual meeting requests through a separate, known communication channel.
• Check the destination before signing in. A familiar logo or meeting title does not establish that a link is legitimate. When in doubt, open Teams or your calendar directly.
• Include calendar lures in awareness training. Employees should recognize that .ics attachments and meeting buttons can be part of a phishing attempt.
• Strengthen account protection. Prioritize phishing-resistant multifactor authentication and monitor suspicious sign-ins.
• Report suspicious invites promptly. If credentials were entered, notify the security team immediately so it can investigate and contain potential account compromises.

References

[1] https://blog.checkpoint.com/securing-user-and-access/fake-calendar-invites-target-thousands-of-organizations-in-microsoft-credential-phishing-campaign/amp