Calendar phishing: backdated invitations are placing malicious links in staff calendars

Since Monday 21 September 2026, Penta’s service desk in Dubai has been clearing a surge of phishing delivered as calendar invitations. The sender impersonates a legitimate user, often someone the recipient deals with every week. The invitation carries a dark, branded panel, the recipient’s own company name and a single button. Penta has blocked the sending addresses and, at the affected companies, added the impersonated users to impersonation protection, the Microsoft 365 control that flags messages claiming to come from a listed colleague.

The delivery method is what makes this work. A calendar invitation is handled differently from an ordinary email attachment. Microsoft’s own quarterly threat report notes that an invitation file can place a malicious link straight into a calendar without the recipient opening or clicking anything. Awareness training built around the inbox does not reach an entry that appears in a calendar.

The invitation is dated in the past, so it never shows in the upcoming view

The invitations Penta saw on 21 September were scheduled for 16 September, a date already gone. An appointment in the past does not surface in the upcoming view, so nobody watches it arrive and nobody has reason to open it. The link sits in the calendar until someone scrolls back to it.

The sender line still gives it away

In one example the invitation came from an address at a plausible corporate domain, while the sender line showed it had been sent on behalf of an unrelated domain in another country. That mismatch is the check worth teaching, and it survives whatever the panel inside the invitation looks like.

Microsoft saw calendar-invitation payloads nearly quadruple in June

The pattern reaches well beyond Dubai. Microsoft recorded calendar-invitation payloads rising 277 percent in June 2026, close to a fourfold increase, while still accounting for roughly 4 percent of malicious payloads overall. Microsoft does not publish the underlying count. For scale, it detected around 7.6 billion email-based phishing threats across the quarter.

What to do when one appears

• Do not press any button inside the invitation.
• Delete the entry. Do not decline it, because a decline can send a reply back to the sender.
• Report it to your IT provider, with the sender address if you can still see it.
• Tell colleagues if the invitation appears to come from you.
• blocking the sending addresses
• the impersonation protection described above
• Safe Links, which checks a link at the moment it is clicked, and zero-hour auto purge, which pulls a message back out of mailboxes once it is found to be malicious
• phishing simulations that cover this pattern

No single setting closes the delivery path. What reduces exposure is the combination Penta already runs for clients:

The rest is recognition at the desk, and the sender-line check takes seconds.

If Penta manages your Microsoft 365, this is handled as part of your managed service and no action is needed from you. If you cannot name who is closing these off in your own Microsoft 365, that is the gap we fill.

References

1. Microsoft Threat Intelligence and Microsoft Defender Security Research Team (2026) ‘Email threat landscape: Q2 2026 trends and insights’, Microsoft Security Blog, 23 July. Available at: https://www.microsoft.com/en-us/security/blog/2026/07/23/email-threat-landscape-q2-2026-trends-and-insights/ (Accessed: 24 September 2026).