Cybercriminals Exploit Google Calendar for Credential-Stealing Malware

Webpronews

Cybercriminals Exploit Google Calendar for Credential-Stealing Malware

First seen 10 Feb 2026, 01:07 UTC • •31.3

Article Content

1 / 5

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

Cybercriminals are using Google Calendar invitations to distribute credential-stealing malware. This campaign targets billions of users who trust these notifications for everyday scheduling. Security researchers report that the effectiveness of this scheme is increasing rapidly, impacting organizations globally.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 193d ago How this analysis works

Timeline

2026-02-09

Webpronews article published detailing the malware campaign

Recent

Cybercriminals began exploiting Google Calendar invitations

More articles in this cluster (4)

Threat Graph

9 entities, 13 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (3)

Malware
Phishing
T1566.002 - Spearphishing Link

Affected Platform (4)

Google Calendar
Google Forms
Google Workspace
Slack

Tool (2)

Gmail
Microsoft Teams

Relationships

Malware targets Google Calendar
Malware targets Google Forms
Malware targets Google Workspace
Malware targets Slack
Phishing targets Google Calendar
Phishing targets Google Forms
Phishing targets Google Workspace
Phishing targets Slack
T1566.002 - Spearphishing Link targets Google Calendar
T1566.002 - Spearphishing Link targets Google Forms
T1566.002 - Spearphishing Link targets Google Workspace
T1566.002 - Spearphishing Link targets Slack
Gmail related to Microsoft Teams

Continue Reading

Critical WSO2 API Manager Vulnerability Under Active Exploitation A critical vulnerability (CVE-2026-5430) in WSO2 API Manager is being actively exploited, allowing unauthenticated attackers to forge admin tokens via JWT authentication bypass. This flaw, which has a CVSS score of 10.0, affects multiple WSO2 products including API Manager, Universal Gateway, Traffic Manager, and API…

Critical Linux Kernel Vulnerability CVE-2025-39682 Under Active Exploitation A critical vulnerability (CVE-2025-39682) in the Linux kernel allows remote code execution through mishandling of zero-length TLS records. This flaw affects kTLS-enabled hosts running vulnerable kernel versions, exposing them to attackers without authentication. CISA added this vulnerability to its Known Exploited…