A supplier sends a meeting invitation. The subject looks routine, the calendar layout feels familiar, and the Join button seems like the next thing to click. That small shift—from reading an email to managing an appointment—is exactly where staff may stop applying the caution they would use with an unexpected attachment.
On 15 October 2026, Check Point Email Researchers reported multiple credential-phishing campaigns using fake calendar invitations. Some carried valid .ics calendar attachments; others used deceptive links. The researchers said activity had surged from 25 September and remained visible on 15 October.
This is observed campaign activity reported by the researchers, not proof that every recipient lost an account. Nor does the report establish an Outlook software vulnerability: the .ics approach abuses calendar functionality and user trust. It also does not establish that AXO, its customers or Malaysian businesses were compromised.
Why the calendar wrapper matters
The lure is the apparent legitimacy of an ordinary business event. A calendar file can be structurally valid while its description or links steer the recipient towards credential theft. “It is not malware” and “it is safe to follow” are different conclusions.
The practical implication for SMEs is to include invitations in phishing training and investigation, not just conventional messages. A fake appointment can borrow context from procurement, recruitment, client onboarding or an urgent management discussion. Those examples are risk scenarios, not claims about the specific campaigns.
Verify the meeting before the sign-in
Staff do not need to become URL analysts. Give them a short rule: an invitation is a request from a sender, not an instruction from Microsoft. Was the meeting expected? Does the organiser match an existing conversation? Is the request trying to rush a login, payment or document review?
If the invitation is unexpected, do not use its links or attachments to investigate it. Contact the organiser through an established number or a separate, known conversation. Microsoft’s phishing guidance recommends verifying suspicious messages through another channel rather than replying to the suspicious message itself.
Open Teams or the relevant business application independently. A familiar logo, a professional signature or a padlock on a website does not prove the invitation is genuine. If joining a supposedly routine meeting suddenly asks for credentials or an unexpected MFA approval, stop and verify the request before proceeding.
Give staff a reporting route that actually works
“Report phishing” is useful advice only if the person can find the control. Microsoft documents support for reporting calendar items in updated classic Outlook builds, but availability depends on the installed version and update channel. Do not assume every employee has the same interface.
Test the process on the devices staff actually use. Where reporting is available, use it; otherwise provide the company’s approved IT or security reporting route. Ask staff to preserve the original invitation for investigation and avoid circulating a clickable copy in a general Teams channel.
IT should check whether the suspicious event remains in the calendar as well as reviewing the email. The investigation is not complete merely because a message has disappeared from the inbox. Preserve relevant evidence before removing malicious content, and check for similar invitations across affected users.
Reduce the value of a stolen password
MFA remains important, but the method matters. Microsoft describes FIDO2 passkeys as phishing-resistant because their cryptography is bound to the legitimate service. A lookalike sign-in page cannot simply collect a passkey in the way it collects a typed password.
Prioritise a planned phishing-resistant authentication rollout for administrators, Finance and other sensitive roles, then extend it to more users. Include registration, lost-device recovery and helpdesk verification. Confirm supported devices, tenant policy and licensing before enforcement; do not lock users out with an untested policy.
Stronger authentication is not a reason to trust every invitation. Staff must still avoid unexpected consent requests, unrequested MFA prompts and instructions to weaken account protection.
If someone already entered credentials
Make early reporting easy and blame-free. Ask what was entered or approved, when it happened and which device was used. Do not ask the employee to paste their password into the incident ticket.
For a suspected compromised Microsoft 365 account, authorised administrators should follow the incident-response process. Microsoft’s guidance includes disabling the affected account during investigation, revoking sign-in sessions, resetting credentials, and reviewing registered MFA methods, application consents and administrative roles. It also calls for checking mailbox forwarding and Inbox rules, including hidden rules.
Review sign-in and audit records to determine what actually happened. Distinguish “received the lure,” “clicked the link,” “entered a password” and “confirmed unauthorised access.” A password reset alone is not evidence that persistence has been removed.
Hypothetical example: A 35-person Malaysian services firm receives an unexpected “supplier review” appointment. An employee notices that the Join link opens a sign-in page rather than the expected meeting. She reports it without entering credentials. IT preserves the invitation, removes matching calendar entries and checks whether anyone interacted with them. Management records an attempted phishing event, not an invented data breach. This is an illustrative scenario, not an AXO client case.
What to change this week
Run one controlled calendar-invitation awareness exercise using an authorised training process. Verify the reporting route, confirm that IT checks both email and calendar, and review the response procedure for a disclosed password. Measure time to report and time to contain—not just how many people clicked.
The useful habit is a pause at the point of trust: verify the meeting before authenticating, and make reporting faster than guessing.
For a practical review of Microsoft 365 security and incident readiness, contact AXO Technologies.
