ICS phishing: Stopping a surge of malicious calendar invites · Blog · Sublime Security

This Attack Spotlight details a surge in "ICS phishing" attacks that abuse calendar invitation behavior in Google Workspace and Microsoft 365 to deliver phishing payloads and leave malicious events on users' calendars even when emails are blocked. The report presents examples (FreeConferenceCall abuse, QR-code leading to credential phishing, attached HTML phishing kits), detection signals (malicious QR links, brand impersonation, suspicious HTML/JS artifacts), and mitigation advice including Google Workspace settings and Sublime's automated removal of malicious calendar events.