You’re Invited: How Attackers Get into Your Calendar the Easy Way

From research to reality 

Minor use of ICS files — files that contain information on events or meeting invites that synch with apps like Microsoft Outlook and Apple iCal — for attacks was first observed between 2020 and 2022, with findings primarily niche, isolated, or research based. It was not until 2025 that ICS files became significant delivery mechanisms for phishing campaigns.

The first significant example was the use of malicious ICS files to exploit a stored XSS vulnerability in the Zimbra Collaboration Suite’s Classic Web Client (CVE-2025-27915). Since then, threat actors have continued to adapt, integrating ICS files into phishing campaigns to bypass email security filters and avoid suspicion. Other researchers, such as those at email security firm Sublime Security has noted “exponential growth” in their observations of calendar phishing and The Guardian has recently reported on campaigns leveraging this TTP to lead victims to fake Microsoft, Google, or PayPal pages. 

Example of an ICS event captured by Netcraft that uses this technique. 

More recently observed exploitation has been focused on exploiting the behavior of the recipient’s email client to bring phishing lures directly into their calendar. This has been accompanied by an increase in observed volume as this TTP has moved beyond academic contexts and entered use by relatively unsophisticated threat actors. 

Why it works 

ICS files are the “text/calendar” MIME type, which is treated as low risk by major email clients. This is because the files are non-executing, structured text. On their own, they may seem no more harmful than a generic TXT file. 

Contents of an ICS file containing an Amazon Prime renewal lure. 

What makes this dangerous is the exploitation of email-calendar client workflows that are expected and relied on by many users.

When an invite is sent to a user, having the item penciled into their calendar helps identify conflicts when scheduling. In this case, however, it allows attackers to go from the target’s inbox to their calendar without user interaction. Ultimately, the lure’s injection into the target’s calendar is a normal and intended behavior of their email client. In many email clients, this allows the invite to persist in the target’s calendar even after the original phishing email is deleted. 

Email-attached calendar invites are now so ubiquitous that the average user may barely scrutinize them. In fast-paced, tech-reliant workplaces, new events appearing in the calendar without manual entry have become normalized. This combination of automatic behavior by email clients, users’ normalized expectations that events simply appear, and persistence even after the original email is deleted gives threat actors an easy route to the user’s attention. 

EvilTokens and beyond: How attackers are weaponizing calendar invites at scale 

Calendar invite abuse has been adopted as a delivery mechanism by widespread campaigns such as those using EvilTokens, a token-stealing phishing toolkit targeting Microsoft 365 accounts that was previously reported by Netcraft. This campaign often used ICS files as low-friction lures, attempting to bypass scrutiny, appearing directly in a user’s calendar, and remaining even if the original phishing email was deleted. Invites associated with this campaign are often disguised as meetings, alerts, or voicemail notifications. When users follow them, they are taken to an attacker-controlled page that gives them a device code and instructions to enter it into Microsoft’s device authorization page. These instructions, presented by the service allegedly notifying the victim, purport to be for the user’s identity verification to access files.

In reality, the user will have allowed another device access to their account through OAuth. user will have allowed another device access to their account through OAuth. user will have allowed another device access to their account through OAuth. user will have allowed another device access to their account through OAuth. 

Example from the EvilTokens Voicemail Cluster captured by Netcraft. 

Campaigns like this take advantage of the automatic processing built into most modern inboxes. Users may also trust their calendar as this attack’s appearance does not align with many users’ expectations of what phishing looks like, and their calendar is a place that they may see as generally under their own control. 

While this shows use of this technique in a sophisticated and widespread campaign, Netcraft has also observed its use in smaller scam efforts. These often include the same lure content as traditional phishing, just inside of an ICS file. The fake Microsoft, Google, and PayPal campaigns mentioned in The Guardian’s report are not confirmed to be an EvilTokens campaign – though they employed similar lures, claiming documents or voicemails were available for review. This is becoming a normalized TTP in the wild. Defenders’ expectations of phishing tactics will need to catch up, or the behavior of email clients will need to change. 

What defenders should do now 

Going forward, it is imperative that email-attached calendar invites are not trusted by default. They are part of the phishing attack surface and are a vector to reach users beyond typical phishing emails. Security teams may wish to review their default email client settings to ensure that employees who should not expect invites from outside of the organization would not have those automatically added to their calendars. For employees who expect meetings from outside of the organization, it is recommended to update phishing guidance to reflect this risk. 

Netcraft’s scanning includes analysis of ICS files, and we are continuing to monitor this tactic’s evolution and increasing use.