Threat Actors Exploit Calendar Subscriptions for Phishing and Malware Delivery

BitSight research found threat actors leveraging calendar subscription infrastructure—frequently using expired or hijacked domains—to push malicious .ics events (URLs, attachments, JavaScript), enabling phishing, malware distribution, and emerging attacks; sinkholing uncovered 347 suspicious domains receiving ~4 million unique IPs/day and the report warns calendar subscriptions are an underappreciated security blind spot.