We’ve seen malicious calendar invites that claim to be warnings about Microsoft account expiration and similar issues.

These invites are typically sent without requiring a response, which causes Outlook to automatically add them to the calendar as tentative. When the reminder pops up, the recipient may panic and look at the action suggested in the body of the invite—hopefully without calling the provided number or clicking any suspicious link.

TJ Caldwell- thanks for sharing and submitting this! Are you seeing malicious .ics files getting sent, emails that claim to be a calendar with malicious attachments, or odd events showing up on calendars? (eg, my personal gmail sometimes auto-adds events from spammy emails.)