Fake Teams and calendar invitations: a Microsoft 365 phishing risk
News date: 2026-10-16 · Last source review: 2026-10-23
Meeting invitations often look more routine than suspicious email attachments. Phishing campaigns exploit that trust with calendar invites, .ics files and links that appear to lead to Microsoft Teams. Check Point reported a substantial increase in such activity in October 2026.
How the attack works
The victim receives a calendar event or email styled as a meeting, payment notice or business update. The description, location or Join button may link to a credential-harvesting page disguised as Microsoft sign-in. The primary mechanism is social engineering rather than a technical vulnerability in the calendar application itself.
- Inspect the true link destination
- Do not trust an event merely because it appears in your calendar
What the research measured
Check Point reported more than 302,000 distinct phishing messages in telemetry from its detection capability, targeting over 40,000 organizations. Those numbers represent the company’s own observations, not the global total of attacks. The trend highlights the need to include calendar invitations in awareness and response programs.
Advice for employees
Confirm unexpected invitations through a known channel. Instead of following an unsolicited sign-in link, open Microsoft 365 through the normal corporate entry point. If you entered credentials, report it promptly and follow your IT team’s procedures for session and credential review.
- Do not scan unverified QR codes in invites
- Report suspicious invitations
- Prefer phishing-resistant MFA when available
Administrator safeguards
Combine anti-phishing policies, sign-in monitoring, Conditional Access, risky-link controls and a clear reporting process. Review how Outlook and corporate calendars auto-process invitations and what warnings users actually see.
- Use privacy-safe real-world training examples
- Prepare a rapid token/session revocation workflow for compromised accounts
VALUE360 helps teams strengthen Microsoft 365 protection, identity controls and practical phishing response.
Explore the related VALUE360 service →
Technical references
Microsoft 365 environment review
Inventory Entra ID policies, user and application permissions, audit logs and exceptions. Pilot changes with a limited group, validate access impact and define a rollback path.
Implementation questions
Does this automatically affect our environment?
No. First verify whether the specific product, version and relevant configuration are deployed.
Is a security tool enough on its own?
No. Combine patching, restricted access, logging and tested backups.