Check Point Email researchers have identified several large-scale phishing campaigns that abuse fake calendar invitations to steal Microsoft account credentials, and the numbers are getting worse by the week. A detection layer built specifically for this attack type has flagged more than 302,386 unique phishing emails sent to more than 40,000 organizations, averaging more than 8,319 emails per active day. The emails came from more than 33,890 different sender domains and more than 247,270 unique sender addresses.
How the attack works
The campaign has two main variants. In the first, the email arrives with an .ics attachment. The file is valid calendar data, so the attack abuses calendar features and user trust without exploiting any software vulnerability. In the second, a fake Microsoft Teams meeting invitation carries a Join link that actually points to a credential-harvesting page disguised as a Microsoft login. Both variants are designed to capture the victim’s username and password. Because the lure travels inside a message format employees see every day, recipients rarely treat it with suspicion, and a malicious event can even plant itself directly in the user’s schedule.
The volume is accelerating
Check Point says activity surged starting September 25, 2026, and it is not fading. Daily volume grew from a few thousand emails a month in April to more than 118,000 in September, and to more than 740,000 in just the first two weeks of October. The busiest single day so far was October 8, with almost 200,000 emails, and the campaign was still active as recently as October 15, 2026. There is no patch to install here, because nothing was broken. The attack weaponizes an ordinary workplace workflow and thousands of disposable sender domains.
What this means for your domain
A campaign spread across tens of thousands of sender domains relies heavily on impersonation. Some of those domains impersonate the brands and formats people already trust, which is exactly the trust gap that email authentication closes. SPF, DKIM and DMARC prove that a message really comes from the domain it claims, and a DMARC policy at quarantine or reject stops forged mail from using your name before it reaches an inbox. If your domain is still at p=none, attackers can put your brand on their calendar invites and your customers will have no technical signal to tell the difference. That is reputation damage and deliverability damage at the same time.
The same logic applies to your own automated mail. Meeting confirmations, notification emails and transactional messages earn quick clicks because they look routine, which makes your sending domain one of the most valuable things you own. Locking it down with enforcement-level DMARC is the difference between a trusted routine and a wide-open attack surface.
Fake calendar invites work because nobody questions a meeting request. Make sure nobody can send one in your name. Excello Mail maps every legitimate sending source and takes your domains to p=reject without breaking real mail. Sign up for free to Excello Mail and keep your brand off the attacker’s invitation list.