Quarantined, but still on your calendar: The explosion of invite-based attacks

Security vendors Check Point and Sublime Security report a sharp increase in malicious calendar invites used in phishing campaigns: attackers send .ics files or calendar links that lead to credential-harvesting pages and, in some cases, deliver a ScreenConnect installer configured as an RMM-based command-and-control channel. The campaigns leverage legitimate services (Google Calendar link rewriting, Framer hosting) to bypass protections; defenders are advised to extend email security to calendar entries, remove associated events when quarantining messages, and train users to verify unexpected or urgent financial-themed invites.