Phishers cast wide net with spoofed Google Calendar invites

Check Point researchers reported a financially motivated phishing campaign that spoofs Google Calendar invites (via modified sender headers and .ics attachments) to lead recipients to malicious Google Forms/Drawings and fake cryptocurrency support pages that request authentication, personal data, and payment information; about 4,000 emails impacted ~300 organizations over four weeks. Recommended mitigations include cautious handling of unexpected calendar invites, hovering over links or typing URLs manually, and enabling two-factor authentication.