Phishing attacks are increasingly using legitimate calendar invites to bypass security filters, according to researchers at Netcraft. Attackers send ICS calendar invite files that plant phishing lures directly on users’ calendars, often under the guise of work-related meetings.
“When an invite is sent to a user, having the item penciled into their calendar helps identify conflicts when scheduling,” the researchers write. “In this case, however, it allows attackers to go from the target’s inbox to their calendar without user interaction. Ultimately, the lure’s injection into the target’s calendar is a normal and intended behavior of their email client. In many email clients, this allows the invite to persist in the target’s calendar even after the original phishing email is deleted.”
Notably, this technique has been incorporated into popular phishing kits, lowering the bar for unskilled threat actors to launch these attacks.
“Calendar invite abuse has been adopted as a delivery mechanism by widespread campaigns such as those using EvilTokens, a token-stealing phishing toolkit targeting Microsoft 365 accounts that was previously reported by Netcraft,” the researchers write. “This campaign often used ICS files as low- friction lures, attempting to bypass scrutiny, appearing directly in a user’s calendar, and remaining even if the original phishing email was deleted. Invites associated with this campaign are often disguised as meetings, alerts, or voicemail notifications. When users follow them, they are taken to an attacker- controlled page that gives them a device code and instructions to enter it into Microsoft’s device authorization page.”
Users need to maintain a healthy sense of suspicion and stay up-to-date on evolving social engineering tactics in order to thwart these attacks.
“Email-attached calendar invites are now so ubiquitous that the average user may barely scrutinize them,” the researchers write. “In fast-paced, tech-reliant workplaces, new events appearing in the calendar without manual entry have become normalized. This combination of automatic behavior by email clients, users’ normalized expectations that events simply appear, and persistence even after the original email is deleted gives threat actors an easy route to the user’s attention.”
Netcraft has the story: https://www.netcraft.com/blog/how-attackers-get-into-your-calendar-the-easy-way
