Fake calendar invites steal Microsoft 365 credentials in mass phishing campaign

Check Point Research has uncovered large-scale phishing campaigns that abuse calendar invites to harvest Microsoft 365 credentials, hiding malicious links in .ics files, QR codes and fake meeting pages. Since September 25, 2026, researchers flagged over 302,386 phishing emails targeting more than 40,000 organizations.

• Over 302,386 phishing emails hit 40,000+ organizations
• Attacks came from 33,890 domains and 247,270 sender addresses
• October volume reached 740,000 emails in two weeks
• Peak day was October 8 with nearly 200,000 emails