{"id":176047,"date":"2026-01-09T16:28:00","date_gmt":"2026-01-09T21:28:00","guid":{"rendered":"https:\/\/testing.news-you-need.com\/index.php\/2026\/01\/09\/meeting-invite-phishing-is-the-latest-cybersecurity-threat\/"},"modified":"2026-01-09T17:05:08","modified_gmt":"2026-01-09T22:05:08","slug":"meeting-invite-phishing-is-the-latest-cybersecurity-threat","status":"publish","type":"post","link":"https:\/\/testing.news-you-need.com\/index.php\/2026\/01\/09\/meeting-invite-phishing-is-the-latest-cybersecurity-threat\/","title":{"rendered":"Meeting-invite phishing is the latest cybersecurity threat"},"content":{"rendered":"

Meeting-invite phishing is the latest cybersecurity threat<\/a><\/p>\n

https:\/\/www.itbrew.com\/stories\/2026\/01\/09\/meeting-invite-phishing-is-the-latest-cybersecurity-threat<\/a><\/p>\n

Publish Date: 2026-01-09 16:28:00<\/a><\/p>\n

Source Domain: www.itbrew.com<\/a><\/p>\n

Author: <\/a><\/p>\n

Using an unordered list, summarize the following article with between 4 and 8 key points. Your machine data knows things: Unlock it with Splunk and get game-changing insights\u2014plus a critical resource to power AI. Tapping into machine data can boost your security and reliability. See more.Like your favorite bosses, even phishers are setting up meetings that could\u2019ve been an email.Cybersecurity teams are facing an increase in calendar-invite phishing messages, IT leads recently shared with IT Brew. That\u2019s a particularly dangerous tactic, given how invites exist beyond the inbox.\u201cEven if you\u2019ve done an effective job of teaching your employees not to click on email links, there\u2019s just an informality to invites that I think makes the social awareness more challenging,\u201d Marty Barrack, chief legal and compliance officer at healthcare IT company XiFin, said.An influx in invites. In an email to IT Brew, Google Workspace spokesperson Ross Richendrfer wrote that Google has seen a \u201cdefinite uptick in the last year\u201d in meeting-invite phishing tactics. (Lawrence Berkeley National Laboratories, for example, alerted users in October of Google invite attacks.)Barrack, who\u2019s also a member of the ISACA Emerging Trends Working Group, said malicious meeting-invite phishing currently makes up about a tenth of the phishing messages targeting the company\u2014a radical change from 18 months ago, when the company hardly saw that type of attack.Here\u2019s how the attack works:A calendar file (.ics) arrives via email.Within those invites, adversaries add malicious links, phony tech support numbers, or attachments.Depending on one\u2019s calendar platform and setting, according to Michael Welch, CISO at consultancy MorganFranklin Cyber, the invite can remain on a calendar even when the original email is reported or \u201csoft\u201d deleted (meaning moved from an active view to a temporary space).\u201cUsers have come to trust the text-based .ics extension that is supported across many clients and their guard is down when it comes from outside the organization,\u201d Welch wrote in an email to IT Brew, adding that his group has not noticed an uptick in the method.What one pro did. Bill Holmberg, IT director at Wayne Transports, hadn\u2019t seen this fake meeting ruse until last November, when employees clicked meeting links that led to replica logins, allowing phishers to send spam messages and spread attacks from familiar company accounts.Holmberg recently spent time checking and unchecking boxes in Microsoft Outlook, enforcing configuration changes to the company\u2019s email-system user base of about 225 employees. His actions included:\u00a0Disabling: \u201cAutomatically process meeting requests and responses to meeting requests and polls.\u201d\u200b\u200bDisabling: \u201cAutomatically accept meeting requests and remove canceled meetings.\u201dEnabling: \u201cDon\u2019t show event summaries in email or on my calendar.\u201dEnabling: \u201cAdd invitations to my calendar\u201d to \u201cOnly when I respond to the invitation.\u201dIn a follow-up email with Holmberg, the director shared that the company uses a secure email gateway to warn users of strong phishing indicators. The global configuration adjustments only stop the automatic acceptance of invitations, he noted, and his IT team trains users to spot the threat.Outlook does provide notifications for users when a sender is potentially suspicious, or at least \u201cone you don\u2019t often get mail from.\u201dWhat Microsoft says. \u201cThis is a challenging tactic because it bypasses current spam filters. Without any user interaction, the invitation is automatically added to the calendar, and can create a false sense of security. Additionally, with AI, attackers can also craft highly convincing emails that appear legitimate and could trick users,\u201d Thomas Roccia, senior security researcher at Microsoft, wrote to IT Brew. He recommended:Deleting the invitation and the email without interacting; do not click any links or reply.Reporting the invite as spam using built-in functions and blocking the sender.\u201cRead carefully, avoid reacting too quickly, verify the origin, and ask yourself if the invitation seems legitimate,\u201d Roccia wrote.What Google says. Via an admin console, Google Workspace customer users can check their Calendar settings to ensure they only add invitations when the sender is known. If an unknown sender wants to add an invite, this \u201cknown senders\u201d setting is an effective defense, according to Richendrfer, and ensures users receive an alert warning about someone they haven\u2019t interacted with previously.Time for an all-hands meeting? Barrack sees a need to expand phishing training beyond the inbox: \u201cI think that the level of effort that has gone into dealing with phish emails has not been reflected in phishing invites. So, I think that the industry and software vendors have some catch-up on this.\u201d
<\/p>\n","protected":false},"excerpt":{"rendered":"

Meeting-invite phishing is the latest cybersecurity threat https:\/\/www.itbrew.com\/stories\/2026\/01\/09\/meeting-invite-phishing-is-the-latest-cybersecurity-threat Publish Date: 2026-01-09 16:28:00 Source Domain: www.itbrew.com…<\/p>\n","protected":false},"author":1,"featured_media":176048,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/cdn.sanity.io\/images\/bl383u0v\/production\/55a53d1b6fae767644c429a8bb0baa10b8e8bf59-5130x3420.jpg?rect=0,363,5130,2693&w=1200&h=630&q=70&fit=crop&auto=format","fifu_image_alt":"","footnotes":""},"categories":[15],"tags":[26,24,25],"class_list":["post-176047","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-ai","tag-cybersecurity","tag-phishing"],"_links":{"self":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/176047"}],"collection":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=176047"}],"version-history":[{"count":1,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/176047\/revisions"}],"predecessor-version":[{"id":176049,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/176047\/revisions\/176049"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/176048"}],"wp:attachment":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=176047"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=176047"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=176047"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}