The Meeting Invite That Was Never a Meeting

A calendar invitation feels like admin, not an attack. It arrives, it has a time and a "Join" button, and most of us respond on autopilot. That reflex is exactly what a large phishing campaign is now using. Check Point Email Researchers reported on 15 October 2026 that fake meeting invitations have been aimed at more than 40,000 organisations, with the aim of capturing Microsoft sign-in details.

This post explains what the researchers observed, why a calendar invite is such a useful disguise, and which practical changes cut the risk without asking people to treat every meeting request as a threat.

What Check Point observed

According to Check Point's write-up, the surge began on 25 September 2026. The researchers flagged more than 302,386 unique phishing emails sent to more than 40,000 organisations, an average of more than 8,319 emails per active day. The mail came from more than 33,890 sender domains and more than 247,270 unique sender addresses.

The growth is the part worth noticing. Check Point reports a few thousand emails in April, more than 118,000 in September, and more than 740,000 in the first two weeks of October. The peak day was 8 October, with almost 200,000 emails, and the campaign was still active on 15 October. In the researchers' words, "Activity is not fading, it is accelerating."

The write-up does not name sectors or countries, and it does not attribute the campaign to a specific group, so this post does not either. It also does not publish recommendations. The defensive advice below is ours, drawn from general good practice and the sources linked at the end.

Why a calendar invite works as a disguise

Most phishing training teaches people to be wary of unexpected attachments and urgent requests for payment. A meeting invite sits outside that mental category. It is short, it has no obvious sales pitch, and declining or ignoring one can feel rude. The sender only needs the recipient to think, "Maybe I missed something."

There is also a technical reason. Check Point states that the attached file "is valid calendar data", which means no software flaw is being exploited. A calendar file (.ics) is a perfectly normal format, so an email gateway looking for malicious code has little to object to. The harmful part is the link, not the file.

The two routes to the fake sign-in page

Check Point describes two delivery methods, and both lead to the same place: a fake Microsoft login page built to harvest credentials.

1. The .ics attachment. The email carries a calendar file. Opening it shows an event with a meeting link or call details, and the link leads to the credential page.
2. The in-body link. The email looks like a Microsoft Teams meeting invite. According to the researchers, hovering over the "Join" link shows a Microsoft sign-in address rather than a Teams meeting address, and the page that follows asks for a Microsoft login.

The diagram shows why the campaign holds together. Each signal is harmless on its own: a routine invite, a valid file, a Microsoft-looking address. The risk sits where all three overlap and a person types a password into a page they reached from a meeting request.

Why invites can reach people who never opened the email

Calendar apps add a second problem. As Malwarebytes explained in November 2025, calendar apps can automatically add invitations that arrive by email, even when the email itself lands in spam, and events then sync across devices. Check Point's report does not say whether this campaign relies on auto-adding, so treat it as a general risk with fake invites rather than a confirmed feature of this one. It does mean a fake event can sit in a trusted place, looking like it belongs to the person's own diary.

What to do about it

None of these steps needs a major project. Most can be changed this week.

• Tighten automatic invitations. In Google Calendar, the setting "Add invitations to my calendar" can be changed from the default of "From everyone" to "Only if the sender is known" or "When I respond to the invitation email", as Malwarebytes sets out. Outlook has a similar option for adding events from email, so check its calendar settings. Administrators can apply a sensible default across the organisation.
• Join from a known place. For meetings the person genuinely expects, use the join button in the real Teams or Zoom app, or a bookmarked address, rather than the link in an unexpected email.
• Look before typing. If a meeting link asks for a Microsoft password the person did not expect to enter, that is the moment to stop and check the address bar. A genuine meeting from a known colleague rarely needs a fresh sign-in just to join.
• Use phishing-resistant sign-in where you can. Passkeys are tied to the real site they were created for, so they will not hand over a login to a look-alike page. Passwords and codes typed into a fake page can be captured, which is why this matters. It reduces the risk rather than removing it, because attackers can still target other routes into an account.
• Treat external invites with a little scepticism. Many mail systems can flag or tag invitations from outside the organisation. A visible "external" label gives people a cue at the moment it is useful.
• Make reporting easy. A single report button, and a quick, friendly reply, matters more than a perfect catch rate. With sender addresses spread across tens of thousands of domains, someone will often spot the odd invite before a filter learns it.
• Delete, then check the other devices. A removed event can reappear through calendar sync, so clear it everywhere and look for subscribed calendars nobody recognises.

Equipping people, not blaming them

Nobody can be expected to scrutinise every meeting request. The sender in this campaign is counting on busy people doing the sensible, polite thing, and on the file looking exactly like the real thing. The fair response is to give people a few simple checks, one safe default for joining meetings and an easy way to report, then support the habit with technical controls that do not rely on anyone being perfect.

Realistic simulation helps here, because it lets people meet a convincing invite in a safe setting and practise the pause. It does not stop every incident, and it works best alongside the settings and sign-in controls above.

The bottom line

This campaign borrows trust from a feature people use every day. The attachment is valid, the invite looks routine and the destination is a believable Microsoft login. The practical answer is layered: control which invites reach calendars, make joining meetings a habit that avoids unknown links, protect sign-ins with passkeys where possible, and keep reporting simple.

Sources and further reading

• Check Point: Fake calendar invites target thousands of organisations in Microsoft credential phishing campaign (15 October 2026)
• Malwarebytes: Fake calendar invites are spreading, and how to remove them and prevent more (November 2025)

Phishing Tackle offers the tools businesses need to strengthen their human risk strategies, with multi-platform testing, real-time behavioural insights, and actionable data to keep your organisation ahead of modern cyber threats.

Contact us today to learn how Phishing Tackle can help safeguard your organisation from the growing array of cyber risks.