‘You have a meeting’: the calendar phishing scam growing exponentially

* A user received a calendar entry prompting review of a project with a link.
* The link led to a website requesting login details, which the user provided.
* This event was identified as a calendar phishing scam.
* Scammers exploit calendar applications that can add invitations automatically without user acceptance.
* Scams include fake meetings, service renewal prompts, and notifications like voicemail or payment confirmations.
* Scammers may use legitimate platforms such as Zoom for invitations to increase perceived credibility.
* The links typically direct users to fake login pages (Microsoft, Google, PayPal) or phone numbers for fraudulent actions.
* Scammers attempt to create borrowed credibility by placing the event alongside legitimate appointments like dentist visits or 1:1 meetings with a boss.
* Users are advised not to click links or call provided numbers until they verify the invitation.

The pervasive nature of calendar phishing stems from exploiting cognitive trust and the automated nature of digital systems. The tactic's effectiveness is amplified because it leverages existing organizational structures—the inherent expectation that work and personal scheduling share a common calendar space, which reduces immediate suspicion. Attackers are not necessarily aiming for mass compromise immediately; they are seeking a moment of distraction and inertia where the user defaults to routine behavior (checking an alert) rather than critical evaluation. The use of legitimate platforms like Zoom masks the threat by embedding it within a context already deemed trustworthy by security software, creating a sophisticated shield against automated blocking. This suggests a pattern where social engineering exploits the established pattern of digital habit, moving from simple phishing to contextual impersonation, which is significantly harder for technical defenses to counter without shifting user behavior entirely toward hyper-vigilance regarding internal context. The crucial point lies in the distinction between missing an event and engaging with it; the attack succeeds by leveraging the perceived weight of institutional scheduling to bypass rational assessment during moments of cognitive load.
Bridge Questions: How can systems be designed to flag contextual anomalies, such as identical scheduling patterns across unrelated entities, rather than just flagging external malicious links? What are the long-term psychological costs of normalizing routine calendar interactions where suspicion is expected? What mechanisms exist for users to rapidly establish verifiable context for an unexpected event without requiring immediate, high-stakes decision-making?