Calendar phishing campaign sends more than 302,386 emails to customers

Check Point Research (CPR) has identified phishing campaigns that use fake calendar invitations to steal login credentials and payment information. The messages target businesses and may arrive as .ics attachments or links in email.

CPR says an attachment can appear to be a meeting request or payment notification and then show up as a calendar event. Its description, location field, or an embedded QR code may lead to a fake Microsoft 365 sign-in page or fraudulent payment portal. In one example, a fake Microsoft Teams invitation linked to a credential-harvesting page on a third-party website.

The invitations are not themselves malicious, CPR says: the campaigns do not exploit a vulnerability or deploy malware. The risk is that recipients may mistake fraudulent calendar details or links for legitimate work messages and share credentials or payment information.

CPR reported that a detection layer flagged more than 302,386 unique phishing emails sent to more than 40,000 organizations. The campaigns averaged more than 8,300 emails per active day, from more than 33,890 sender domains and more than 247,270 sender addresses. CPR said activity surged from September 25, 2026. It reported more than 740,000 emails in the first two weeks of October, with October 8 the busiest day so far at almost 200,000 emails.