CalPhishing: How Cybercriminals Are Turning Calendar Invites into Credential Theft Traps

One emerging technique, known as CalPhishing (Calendar Phishing), demonstrates how attackers can manipulate meeting-booking processes to steal employee credentials.

Recent threat research published by Fortra highlights an attack technique in which cybercriminals exploit something surprisingly simple: an employee’s willingness to help a potential customer connect with the right person.

The result? A malicious meeting-booking link travels through an organisation’s internal communication channels, gaining credibility along the way.

What Is CalPhishing?

CalPhishing is a social engineering technique that uses calendar invitations, meeting-booking links, and scheduling workflows to deceive employees into interacting with malicious content.

Unlike conventional phishing attempts that rely on threatening messages or urgent requests, CalPhishing often blends into routine business activities.

Consider how frequently employees interact with calendar invitations:

• Scheduling meetings with prospective customers.
• Accepting invitations from vendors and business partners.
• Forwarding meeting requests to colleagues.
• Connecting Microsoft 365 or other workplace accounts to scheduling platforms.
• Accessing external meeting-booking links.

These activities are normal parts of business operations, which makes them attractive opportunities for cybercriminals. Attackers exploit this familiarity to make malicious requests appear legitimate.

How Does a CalPhishing Attack Work?

Recent research has identified a variation of CalPhishing that relies on building trust through multiple employees rather than directly targeting the intended victim. Here’s how such an attack can unfold.

Step 1: The Attacker Pretends to Be a Potential Customer

A cybercriminal approaches an employee, expressing interest in purchasing the organisation’s products or services. The message may appear completely harmless:

There may be no suspicious attachment, threatening language, or obvious malicious link. The request simply looks like a potential business opportunity.

Step 2: An Employee Becomes the Unintentional Middleman

The employee responds helpfully, offering to connect the prospective customer with the appropriate sales representative. The attacker then provides a meeting-booking link and requests that it be shared with the sales team.

The employee forwards the message internally, unaware that the scheduling link is malicious. This is where the attack gains credibility.

Step 3: Internal Communication Creates False Trust

The sales representative receives a meeting request forwarded by a known colleague. Because the email originates from an internal employee, the recipient may be less suspicious. Instead of questioning the external booking link, the sales representative sees what appears to be a legitimate lead.

The attacker has successfully used an internal employee to establish trust without compromising that employee’s account.

Step 4: A Fake Booking Page Captures Attention

When the sales representative clicks the meeting link, they are redirected to a website resembling a legitimate scheduling platform. The page may allow the employee to select a convenient date and time, reinforcing the impression of a genuine business interaction.

However, the final step introduces an unexpected requirement.

Step 5: The Employee Is Asked to Sign In

After selecting a meeting time, the page requests authentication using a Microsoft 365 work or school account. The prompt may claim that authentication is necessary to confirm, synchronize, or secure the meeting.

The objective is to persuade the employee to enter their corporate credentials into an attacker-controlled page. If successful, the attacker could obtain sensitive login information and potentially gain unauthorised access to workplace accounts.

Why Is This Attack Particularly Dangerous?

What makes this technique concerning is that attackers do not necessarily need to compromise an account or impersonate a senior executive. Instead, they exploit normal employee behaviour.

The Bigger Security Challenge: Managing Human Risk Across Trust Chains

Traditional phishing awareness programmes frequently focus on teaching employees to identify suspicious senders, unexpected attachments, or urgent language. These remain important, but modern attacks increasingly exploit situations in which individual actions appear legitimate.

An employee forwarding a sales enquiry may be following an established business process. A sales representative opening a scheduling link may simply be doing their job. Yet the combination of these seemingly harmless activities can expose an organisation to credential theft.

This highlights a fundamental challenge for cybersecurity teams:

Human cyber risk cannot be evaluated only through isolated actions. Organisations must also understand how employee behaviour interacts with evolving attack techniques.

Effective Human Risk Management requires a continuous approach that combines awareness, behavioural assessment, phishing simulations, and measurable risk intelligence.

How Can Organisations Protect Employees Against CalPhishing?

1. Verify External Meeting-Booking Links

Employees should carefully inspect unfamiliar booking domains, even when links arrive through internal colleagues. An internal forward does not automatically validate the safety of the original link.

2. Question Unexpected Authentication Requests

If an unfamiliar meeting-booking website requests corporate Microsoft 365 credentials, employees should verify the requirement independently before proceeding. Authentication should take place through trusted, verified services.

3. Strengthen Awareness Beyond Email Phishing

Security education should address the broader social engineering landscape, including:

• Calendar phishing and fraudulent meeting requests.
• Business email compromise and impersonation.
• Credential-harvesting websites.
• QR-code phishing and collaboration-platform threats.
• Multi-stage social engineering and trust exploitation.

4. Encourage Verification Before Forwarding

Employees should understand that forwarding external content introduces potential risks for colleagues. Where practical, external meeting requests should be routed through approved business processes rather than blindly forwarding unfamiliar links.

5. Continuously Measure Employee Risk

Organisations should evaluate how employees respond to phishing scenarios, identify recurring risky behaviours, and deliver targeted awareness interventions. Rather than treating security awareness as an annual compliance activity, businesses should focus on measurable behavioural improvement.

6. Combine Human Awareness with Technical Controls

Email security, domain reputation checks, phishing-resistant multifactor authentication, identity protections, and suspicious sign-in monitoring all contribute to reducing exposure. No individual security control can eliminate social engineering risk.

Where PhishSheriff Fits In: From Phishing Awareness to Human Risk Intelligence

At PhishSheriff, we believe that building cyber resilience requires more than teaching employees to recognise suspicious emails. Organisations need to continuously understand, measure, and reduce the human behaviours that attackers exploit.

PhishSheriff’s AI-driven Human Risk Management and Email Trust Intelligence platform brings together phishing simulations, cybersecurity awareness, behavioural intelligence, and a unified Human Risk Score to help organisations strengthen their human security posture.

Through its capabilities, PhishSheriff enables organisations to:

PhishSheriff’s broader simulation and awareness capabilities support preparedness for social engineering threats.

Final Thoughts: The Next Cyberattack May Come Through a Trusted Colleague

CalPhishing serves as an important reminder that attackers are no longer relying exclusively on suspicious emails or obvious impersonation attempts. They are learning to exploit the very processes that keep modern organisations productive.

A potential sales enquiry, a helpful colleague, and an ordinary meeting-booking link can become part of a sophisticated credential-theft attempt.

Organisations must therefore rethink how they approach employee security. The goal is not to discourage collaboration or create unnecessary suspicion. It is to build a workforce capable of recognising unusual requests, verifying unfamiliar destinations, and making informed security decisions.

Because in today’s threat landscape, trust should be verified, not assumed.