Phishing scams using Google Calendar invitations

Denison’s cybersecurity intelligence has observed a tricky phishing attack, targeting Denison using Google Calendar invitations. Attackers are sending fake calendar invites, taking advantage of calendar invitation settings designed to make it easy to schedule meetings.

This phishing technique sends a Google Calendar invitation directly to your calendar, which bypasses email spam filters. By default, Google automatically adds calendar invites directly to your calendar. The attackers’ invitations appear genuine alongside your real events, classes, and meetings.

What do I do if I get a suspicious Google Calendar invite?

• Select “Report as spam” in Google Calendar to report the event.
• Do not click “Accept” or “Decline.” This encourages the attacker to try again.
• Do not click links, call phone numbers, or reply to a suspicious event.

What’s the attacker trying to do?

In short, attackers disguise their phishing lure as a harmless calendar event to increase the likelihood you will interact with it. The attacker’s goal is to get you to contact them, where the real attack occurs. They’ll try to get credit card details or login information if you call the phone number or click any links.

How do I spot the attack?

Watch for these red flags in suspicious calendar invitations:

• The invitation organizer isn’t someone you know, and the invitation didn’t come from a denison.edu email address.
• Titles can reference anything, but they focus on invoices and calls to action. For example:
  • Invitation: PayPal to BTC payment finished @ Wed Nov 5, 2025
  • Invitation from an unknown sender: 🚨 Action Required: Reconfirm Device Registration @ Wed Feb 11 8:06am – Thu Feb 12, 2026 8:06am (EST)
  • Invitation: 💼 Invoice Generated – Payment Successful @ Fri Nov 28 7:39pm – Sat Nov 29, 2025 7:39pm (EST)
• The event description can often include a phone number to “cancel” or a malicious link they want you to use.

How do I prevent these invitations?

You can limit who can add events to your Google Calendar.

If you want to adjust your calendar settings to restrict who can send you invitations:

1. Open Google Calendar in your web browser.
2. Click on the gear icon ⚙️in the top-right corner, then select Settings.
3. In the left-side menu, choose Event settings.
4. Under Add invitations to my calendar, select either:
   • Only if the sender is known. Events are automatically added to your calendar if the sender is in your contacts, part of Denison, or someone you previously interacted with.
   • When I respond to the invitation in email. An event is only added to your calendar after you’ve responded to the email notification. This is effective, since our email filters are better tuned to stop phishing messages.

Choose the option that works best for you. While these settings increase protection, be aware that they can change how legitimate invitations work, too. For example, in some cases:

• You might need to manually click Yes in the invitation email to add an event to your calendar.
• Invites from new external contacts (like vendors and new colleagues) won’t show up automatically until you take action in your email.

Edit (Feb 17, 2026): We cannot attribute the invitations to a single threat actor or group. Therefore, we consider each invitation to be a discrete event.