The Payload Was a Phone Number: How a Google Calendar Invite Weaponized Vishing

A threat actor registered scoolsd.com on 2026-03-17 and used a Google Workspace account to send a calendar invite impersonating a billing notice for “CoreDefense Plus” that contained a toll-free callback number ((808)-321-8085) to phone-social-engineer the recipient; there were no malicious links or executable payloads, DKIM passed, SPF was absent, and the only technical IOCs were the domain, sender email, phone number, and an ICS file hash.