Google Calendar Phishing Scam Targets Users with Malicious Invites

Researchers report an active phishing campaign abusing Google Calendar invites and Google services (Forms, Drawings) to bypass email security and lure victims to credential- or data-harvesting sites; over 4,000 emails affecting about 300 brands were observed in a four-week period, and attackers rely on impersonation, urgency, and modified sender headers to increase credibility while redirecting victims to fake login or payment pages.