The Silent Invitation: A Deep Dive into Calendar Invite Phishing

KnowBe4 Threat Labs analyzes an escalating global calendar-invite phishing campaign that exploits default calendar behaviors (auto-accept and uninspected .ics metadata) and platform trust to bypass email defenses. Attackers use four vectors—vishing/payment lures, fake Zoom updates that drop RMM agents, platform impersonation with AiTM credential-harvesting pages, and internal-company impersonation—to achieve credential theft or persistent remote access; the report describes the delivery-to-exploitation lifecycle and recommends controls such as .ics inspection, link sandboxing, disabling auto-accept, strict sender verification, and risk-first training.