The strangest story in cybersecurity news today needs no click to reach you. A calendar invite scam is phishing delivered as a meeting invitation: a scammer sends an invite, your calendar settings add it on their own, and an event you never accepted sits on your calendar with a reminder set for later. When the reminder pops, the event text does the work. It carries a link to a fake sign-in page, a file presented as a meeting document, or a phone number for a fake support line. The same lure family has two more members: spoofed Google Meet invites whose link downloads malware, and fake Google support messages that push you to reset your account. Sublime Security measured calendar-invite (ICS) phishing up about 33,000 percent between May and September 2026, as reported by TechSpot. This page states what is confirmed, then gives you two working checks: an analyzer for a meeting link or a pasted invite, and the hardening list that closes the door.
Because the calendar and the inbox apply different rules. Gmail can send the invitation email to spam while the calendar still adds the event, so deleting or filtering the email does not remove the appointment. Sublime Security has also seen invites sent through real services, including Microsoft Teams, Zoho Calendar, and Calendly, which gives the lure a genuine sending path instead of a spam-shaped one. The titles do the rest: invites pose as invoice or payment notices and as fake voicemail alerts, subjects a busy person acts on without thinking. Check Point documented a calendar-invite campaign whose goal was the victim's Microsoft login: the invite carried the victim to a fake sign-in page, and one login opened the mailbox behind it. That is the shape to assume for any invite you did not expect: it wants a credential, a download, or a phone call, and it has all day to wait for the reminder to fire.
Paste a meeting link, or the full text of an invite (subject, sender line, event text, and links). Everything runs in your browser; nothing is sent anywhere. Every flag shows the exact text it matched.
Four defenses decide whether this scam can reach you at all. Tick each one you have actually done. The readout states plainly whether your calendar is still open to auto-added invites, and it ends with the most important action you have not taken.
DomainGuard, Ingenious AI's lookalike-domain watcher, exists for the host trick at the center of this scam: a name that reads as Google at a glance and is not Google at all. The analyzer above reads one link at a time. DomainGuard watches the registration side, flagging lookalike domains aimed at your brand before the invites that use them go out. See DomainGuard.
One vendor, one security posture. Every platform below is live now on getingeniousai.com.
It is phishing delivered as a meeting invitation. A scammer sends a calendar invite that your settings add to your calendar automatically, so an event you never accepted appears with a reminder set. The event text carries the payload: a link to a fake sign-in page, a file presented as a meeting document, or a phone number for a fake support line. The same lure family includes spoofed Google Meet invites whose link downloads malware, and messages that pose as Google support and push you to reset your account. Sublime Security measured calendar-invite phishing up about 33,000 percent between May and September 2026.
No. The Guardian's guidance on this scam is direct: a fake event on your calendar does not mean your account is compromised, and the sender has no access to your account or your other events. The compromise starts only if you act on the event: click its link and sign in, download its file, or call its number and follow the instructions. If you did none of those, report the event as spam and tighten the invitation setting. If you did click or call, treat it as a real incident: change the password at the real site, and check your account's recent activity.
In Google Calendar on a computer, open Settings, then Settings again, and find Event settings under General. Set 'Add invitations to my calendar' to 'Only if the sender is known'. Google counts a sender as known if the sender is in your contacts, in your organization, or someone you have interacted with. For stricter control, choose 'When I respond to the invitation in email', so nothing lands on the calendar until you answer the email. The setting applies to new invitations only, so review events that are already there. Also open Google Contacts, check 'Other contacts', and remove senders you do not recognize, because an auto-saved sender can count as known.
No. Any response, including Decline, tells the sender your address is live and monitored, which invites more attempts. Open the event in Google Calendar and use Report as spam instead, which removes it without answering the sender. Then verify any real meeting the event claims to be about through a phone number or a website you already know, never the number or the link inside the event itself.
Sources: Rossen Reports segment, October 25, 2026 (the three-lure warning aimed at Google users and the known-sender setting advice) · Sublime Security research, as reported by TechSpot (calendar-invite phishing up about 33,000 percent between May and September 2026, and delivery through real services including Microsoft Teams, Zoho Calendar, and Calendly) · Check Point research (the calendar-invite campaign aimed at the victim's Microsoft login) · Google Calendar help documentation (the "Add invitations to my calendar" setting, what counts as a known sender, and the rule that the setting applies to new invitations only) · The Guardian (a fake event on your calendar does not mean your account is hacked, and the compromise starts at the click, the download, or the call).