Large Calendar Phishing Campaign Targets Microsoft 365 Users

• •Over 302,000 unique phishing emails targeting Microsoft 365 users detected.
• •Attack methods include fake meeting invites and malicious ICS file attachments.
• •Significant increase in phishing activity observed, especially in October 2026.

A phishing campaign has been detected targeting Microsoft 365 users, with over 302,000 unique calendar phishing emails sent to more than 40,000 organizations. The campaign, identified by Check Point, has seen a significant increase in activity, particularly in October 2026, with nearly 200,000 emails sent on a single day. Attackers are using fake meeting invitations that include malicious links or ICS file attachments to harvest Microsoft account credentials. The methods exploit user trust in calendar notifications, which are often treated with less scrutiny than regular emails. This surge in attacks has been corroborated by multiple security firms, including Sublime Security, which reported a 1,216% increase in malicious invites in August 2026. The phishing emails are designed to bypass traditional email security measures, making them particularly dangerous for organizations relying on Microsoft 365 workflows.