Explosion of calendar invite-based phishing attacks

Check Point and Sublime Security report a sharp rise in phishing via malicious calendar invites: Sublime saw a 1,216% month-over-month jump in August 2026, while Check Point tracked growth from a few thousand emails in April to over 740,000 in the first two weeks of October. Attackers attach .ics files and links to spoofed Microsoft sign-in pages to steal credentials.

• Sublime recorded a 1,216% month-over-month rise in August 2026
• Check Point saw over 740,000 such emails in early October
• Attacks abuse valid .ics calendar data, not software flaws
• One campaign used Framer to deliver a ScreenConnect C2 tool