Phishers Spoof Google Calendar Invites in Fast-Spreading, Global Campaign

Check Point researchers discovered a fast‑spreading phishing campaign that spoofs Google Calendar invitations to bypass email protections and steer victims to Google Forms/Drawings and fake reCAPTCHA pages; the goal is credential theft and downstream financial scams. Analysts observed over 4,000 malicious messages in four weeks referencing about 300 brands, and recommended mitigations including enabling Calendar "known senders", deploying advanced email scanning and URL reputation checks, enforcing MFA, and user training.