Google Calendar Event Injection with MailSniper

Black Hills Information Security demonstrates an "Event Injection" issue in Google Calendar where an attacker can insert events into a victim's calendar (without sending email) and, using the Calendar API, mark attendees as 'accepted' to bypass user protections—enabling highly effective social-engineering/phishing. The post includes MailSniper PowerShell modules and detailed OAuth/API steps to perform the injection, discusses mitigations and settings, and provides a disclosure timeline with Google.