Over 390 Abandoned iCalendar Sync Domains Could Expose ~4 Million Devices to Security Risks

Bitsight analysts discovered an active campaign where attackers re-register expired calendar subscription domains to serve malicious .ics files and obfuscated JavaScript, causing background-synced calendar requests from iOS/macOS devices to receive phishing, scareware, and redirect payloads; the investigation identified ~390 abandoned domains receiving requests from roughly 4 million unique IPs and highlighted indicators such as Accept:text/calendar requests and iOS calendar User-Agent strings.