These days it can feel like workdays revolve around a steady stream of meeting notifications; team check‑ins, project updates, surprise invites from departments you forgot about. Cybercriminals know this, too, and now they’re exploiting it.
Across industries, cyber security teams are warning about a growing threat: meeting invite phishing, a tactic where attackers send fake calendar invitations designed to steal login credentials or install malware. These invites look official and often bypass standard email defenses, so many people don’t realize they are a scam.
This blog breaks down how the scam works, how to detect it, and what you can do to protect yourself.
Meeting invite phishing is a social engineering method where attackers send a fake calendar invitation often as an .ics file attachment to trick people into clicking malicious links or sharing sensitive information.
Simply: It’s a phishing email disguised as a calendar meeting.
These invites are designed to look like real Zoom, Teams, Google Meet, or internal company events. Many calendars' settings default to automatically add any meeting invites without user approval, so the meeting scam can appear more trustworthy than a typical phishing email.
An .ics file is a universal calendar format used by:
Almost every platform accepts .ICS files which makes it an easy target for attackers to use to sneak malicious content through filters. Some security tools scan email bodies, but not calendar event files which makes them a perfect loophole for calendar invite scams.
Organizations like Google, Microsoft, and cybersecurity groups have reported a increase in meeting scams because of these reasons:
We’re conditioned to treat meeting requests as routine and legitimate, not suspicious.
Many systems automatically add events to your calendar even if the original email is flagged or soft‑deleted.
For companies that have multiple branches, are all remote, or hybrid, the amount of meetings being made increases. The more meetings we attend, the easier it is for a malicious invite to blend in.
Attackers can generate highly polished, personalized invitations that look identical to real company communications. Including mimicking a employee’s voice or email.
All these factors make meeting invite phishing one of the fastest‑growing social engineering tactics today.
These are the signs you should watch out for every time you receive a meeting request especially unexpected one.
These inconsistencies are often easy to spot:
These require a closer look:
These focus on how the invite makes you feel:
If anything feels rushed, odd, or out of character, trust your instincts.
Most attacks follow a predictable pattern:
The consequences vary, but they’re all serious.
Fake login pages are designed to capture:
Once inside, attackers may:
One compromised account can:
You don't need to be an IT expert to prevent these attacks. A few simple habits make a huge difference.
For readers with leadership or admin roles, here are common security measures organizations are adopting:
A simple 5‑step guide:
Meeting‑invite phishing isn’t just another cybersecurity trend, it’s a sign of how social engineering continues to evolve. Attackers know that people trust calendar invites more than emails, and they’re exploiting this gap.
But with awareness, small setting changes, and a habit of verifying unexpected invites, anyone can avoid this scam. Your calendar should help organize your day, not compromise your account.
An Outlook scam email is a phishing message that appears to come from Microsoft Outlook but is actually designed to trick you into clicking malicious links or accepting fake calendar events. Attackers often send scam email from Outlook containing .ics files that automatically add events to your calendar, making the meeting request look legitimate. These calendar entries can contain dangerous “Join Meeting” links that lead to credential‑theft pages.
A Google Meet scam involves a fake meeting invitation that looks like it was scheduled through Google Meet. These Google Meet scams typically include a “Join Meeting” link that directs you to a spoofed Google login page designed to steal your Google Workspace or personal Gmail credentials. If your Google Calendar automatically accepts invites, these events can appear without you realizing they came from a suspicious sender.
Yes, Zoom meeting scams are increasingly common. Attackers send fake Zoom event invitations or .ics files that mimic real Zoom links. The malicious link may look like a standard “Join Zoom Meeting” URL but instead redirects to a credential‑harvesting page. Because Zoom is widely used across industries, these fake invites blend in easily.
Whether it’s Outlook, Gmail, Teams, Google Meet, or Zoom, meeting scams work in similar ways: