Calendar phishing scams are on the rise, preying on users’ trust in their digital calendars. As we prepare for our weekly schedules, an entry might appear unexpectedly, indicating a meeting we don’t remember scheduling. Clicking on it brings up a note requesting logon information, leading to a fraudulent website. This scenario, rather than merely a memory lapse, could mean you’ve fallen victim to a sophisticated phishing scheme.
According to Luke Wescott, a threat detection engineer at Sublime Security, this type of scam is relatively novel but has seen “exponential growth.” Scammers employ various tactics, including sending emails that generate calendar invites even without user acknowledgment. Such invitations can contain requests for fake meetings or service renewals, appearing in both work and personal calendars.
The process begins with a seemingly innocuous email received by the victim, which may end up in spam or be overlooked entirely. Wescott notes that, unlike typical phishing emails, these calendar entries may be treated differently due to their visibility in personal schedules alongside genuine appointments.
Scammers take advantage of calendar applications like Google Calendar, which can automatically add invitations. As Wescott explains, “Scammers don’t even need you to open an email.” This ease of integration creates a false sense of legitimacy that can mislead users.
Max Gannon, an intelligence analysis manager at Cofense, indicates that scammers sometimes utilize reputable platforms, such as Zoom, to dispatch invitations. This complicates detection efforts, as even advanced security software struggles to filter out these threats without potentially blocking legitimate communications.
Recognizing the Threat
Users often receive calendar entries bearing alarming titles like “New voicemail received” or “Your auto-payment will be processed within 24 hours.” Such titles are designed to stir concern and prompt immediate action. Gannon warns that some invitations may appear to originate from within an organization, complete with company logos, making them all the more convincing.
The description of these misleading events typically contains harmful links or phone numbers. Victims are lured into either clicking a link leading to a counterfeit login page or contacting a fraudulent “support” number.
Fortunately, users remain safe until they interact with the scam. Until a link is clicked, or a call is made, the scammers do not have any access to calendar details. Wescott clarifies that this method employs familiar phishing tactics, albeit delivered via a different channel.
Preventive Measures
Encountering an unexpected calendar entry should not induce panic. Instead, users should react as they would to a questionable email and refrain from clicking on any links. “My top advice is to consider every invitation suspicious, even those from known colleagues,” Gannon advises.
Wescott recommends altering settings in Google Calendar to disable automatic acceptance of invitations. Users can choose to receive invitations only from recognized contacts or require manual acceptance. Additionally, it’s wise to avoid clicking “decline” on suspicious invites, as this could confirm the user’s email address as active. Instead, deleting or marking the entry as spam is advisable.
Editor’s Take
This surge in calendar phishing poses significant risks to both individuals and organizations. As users become more dependent on digital tools for their schedules, understanding these threats is crucial. Companies must prioritize cybersecurity training to empower employees against such scams, thereby safeguarding sensitive information and maintaining trust in digital communication platforms.
Source: www.theguardian.com
