Calendar phishing
Calendar phishing uses an event invitation or calendar entry to deliver a deceptive request that tries to induce a harmful action, such as following a malicious link or disclosing information.
A calendar entry can make an unsolicited request look like an appointment already on the schedule. The platform may be genuine while the event’s author is trying to mislead the recipient. Not every unwanted invitation is phishing; the deceptive request and intended action are what matter.
Sublime documented a Google Calendar invitation whose link led to a supposed credit note and then a remote-management installer configured for attacker use. The invitation was the lure; the attacker still needed the recipient to follow the link and run the installer.
Check the calendar as well as the inbox
Google Calendar can add invitations automatically, depending on the user’s settings. Its known-sender option includes contacts, organizational senders, and people the user has interacted with. “Known” in that setting does not independently verify the purpose of a new request.
For supported Google Calendar events, reporting an event as spam removes it, including its recurring series. Google’s instructions exclude events created by other providers, apps, or services. Use the organization’s reporting route when that option is unavailable.
The calendar-cleanup article covers removal and reporting. If the invitation asks you to switch to a call, chat, or download, check the original request through a known contact before continuing. The channel-handoff article follows those transitions.