Google Calendar Phishing: One Link, Two Scanner Verdicts

An attacker created a Google Calendar event with a voicemail lure that caused Google to send an authenticated calendar notification containing a google.com redirector to a freshly-registered malicious domain (voiceml.space); automated scanners returned conflicting verdicts (wrapper scored clean, bare domain partial) and a VIP recipient reported the event, preventing compromise. The report recommends treating platform redirectors as pass-through, factoring domain age into scoring, prioritizing organiser/Reply-To analysis for calendar notifications, and improving executive reporting paths.