Calendar Phishing Attacks Surge 33,000%: Scammers Weaponize Meeting Invites

Your calendar pings. A meeting invite arrives from someone you don't recognize, or worse, from someone whose name you almost know. The subject line is generic—"Urgent Discussion" or "Project Update." You click to see the details. That click is the moment a scammer has been waiting for.

Calendar phishing has become one of the fastest-growing attack vectors in cybersecurity, with reported incidents climbing 33,000 percent in recent years. The mechanism is simple and effective: attackers send unsolicited meeting invitations to corporate email addresses, betting that the casual nature of calendar notifications will bypass the skepticism users normally apply to suspicious emails. A meeting invite feels different from a phishing email. It arrives through a trusted system. It looks official. It carries the weight of workplace obligation.

What makes calendar phishing particularly dangerous is how it exploits a fundamental human behavior. People are conditioned to respond to meeting requests. They click to view details, to accept or decline, to see who else is attending. In that moment of interaction, the attacker's link can execute, or a malicious attachment can deploy. The goal is almost always the same: steal credentials. Once an attacker has login information, they have access to email, files, financial systems, and whatever else lives behind that person's authentication.

The attack works because it operates in a blind spot. Most people think of phishing as something that arrives in their inbox—a suspicious email with a too-good-to-be-true offer or an urgent request from their bank. Calendar invites feel categorically different. They're administrative, routine, part of the normal rhythm of work. Security awareness training has taught people to scrutinize emails, but calendar notifications often slip through that same mental filter. An attacker counting on that gap has found fertile ground.

The scale of the surge suggests that threat actors have recognized this vulnerability and are exploiting it systematically. A 33,000 percent increase is not a marginal uptick—it reflects widespread adoption of the tactic across multiple criminal campaigns and organized groups. When an attack method proves effective and easy to execute, it spreads. Other attackers copy it. Tools get built around it. What was once a novel technique becomes standard practice.

Organizations are beginning to respond. Security teams are recommending that employees treat unsolicited calendar invites with the same caution they would apply to unexpected emails. Some companies are configuring their calendar systems to filter or flag invitations from external senders, creating a buffer between employees and potential attacks. Others are rolling out training programs specifically designed to teach staff how to recognize and report calendar phishing attempts.

The challenge is that calendar systems were not designed with adversarial use in mind. They were built to facilitate scheduling, not to defend against social engineering. As attackers continue to find new angles of approach, the security perimeter keeps expanding. The inbox was one frontier. The calendar is another. The question now is whether organizations can educate their users and configure their systems faster than attackers can refine their techniques.