The Invite You Don't Recognize: How Calendar Invites Became a Phishing Channel

Key takeaways

• The invite looked real because it came from a compromised account, so SPF, DKIM and DMARC all passed.
• The "overdue invoice" lure hid a link chain, from a legitimate hosting page to a bot check to a fake Google sign-in.
• Judge what the message asks you to do, not who sent it. Adaptive caught it and removed it from the inbox and the calendar.

Want more from Adaptive in your Google results?

The invitation looked like any other. "Due Notification," Monday, 1 p.m. CEST. It came from a real person at a company that had owned its domain since 2008, and it passed SPF, DKIM and DMARC. The sender wasn't spoofed. The account itself had been compromised.

There was no meeting, though. Inside the invite was an "overdue invoice," a warning that "mediation" had been scheduled, and a single link that ended at a fake Google sign-in page.

Adaptive Email Security caught it after delivery and pulled both the email and the calendar event it had created.

Employees are trained to be suspicious of unexpected emails that ask them to click something. A meeting invitation gets less scrutiny. It arrives as an email, but it looks administrative, and depending on the recipient's settings it may already be on their calendar with reminders set before they've opened it.

The "Due Notification" invite

Here's a real attack that targeted an Adaptive Email Security customer.

The invite

A native Google Calendar invitation titled "Due Notification," sent from a real business account that had been compromised.

The email claimed an invoice was overdue, said mediation had been scheduled, and warned of further recovery action without notice if the recipient didn't respond. The only call to action was a link labeled "View Attach"

Several details don't hold up. An invoice doesn't need a meeting. "Mediation" over an unpaid invoice is a legal escalation that would normally come by letter or from a named contact, not as a calendar hold. And "View Attach" is a clumsy stand-in for "View Attachment," pointing to something that isn't attached.

The link chain

If the end user clicked on the "View Attach" link, they would have been led to a page on buildin.ai, a legitimate document-hosting and creation service. The invitation itself does not contain a bad URL, which makes it far less likely to be blocked when it's scanned.

A page on buildin.ai, a legitimate document-hosting service. Some email vendors would miss the malicious payload because this points to a reputable site.

The next hop was a bot check, which blocks the automated scanners and bots that would otherwise follow the link and classify the page.

The final page was a fake Google sign-in. At this point in the link chain, the end user may be less on guard, and may not notice that the sign-in page is not legitimate and is in fact a credential harvesting page.

The four-part playbook

The calendar invite attacks we see vary in pretext and target, but they tend to follow the same four moves.

1. 1Borrow a trusted sender. A compromised account at a vendor, partner or customer gives the invitation a real history and a real domain. The more real the sender, the less any filter or person questions it.
2. 2Use a business process as the pretext. Alongside familiar fake-meeting lures, attackers use non-meeting events such as an overdue invoice, a payment dispute or a compliance deadline. People expect calendars to carry deadlines and reminders, so these don't look out of place.
3. 3Launder the link. Instead of linking straight to a phishing page, the invite links to a page on a legitimate document service or a trusted redirect. Email security vendors see a reputable domain.
4. 4Gate the landing page. A bot check sits in front of the credential page. Automated scanners or bots stop at the challenge; a person clicks through.

Why it got past the usual defenses

Rules-based email filters check the sender, the domain and the links. This message passed all of those checks.

• Authentication passed. This was a real employee of a trusted company who had their account taken over by a malicious actor. SPF, DKIM and DMARC all passed because the email was trusted. There was no spoofing or lookalike domain to flag.
• Reputation was good. A domain registered in 2008 with a normal sending history doesn't trip reputation filters. The native filter delivered the invitation to the inbox, and for the same reason the event appeared on the calendar.
• The visible link was clean. The only URL in the invitation pointed to a legitimate hosting service.
• The real destination was gated. Scanners that followed the link hit a bot check before reaching the credential page.

Why people fall for it

This lure works on people for three reasons.

• Urgency with a deadline. The event has a specific date and time, and the body threatens action without notice.
• Authority by format. A calendar invitation feels administrative and pre-approved, as if someone legitimate already put it on the schedule.
• The right audience. Overdue-invoice language is aimed at accounts payable and finance, the teams that handle invoices all day. Invoice and payment pretexts remain among the most expensive forms of fraud: the FBI's 2025 Internet Crime Report recorded 24,768 business email compromise complaints and more than $3 billion in losses.

Red flags a trained employee could spot:

• An invoice, payment demand or legal notice delivered as a calendar invite
• A sender the employee doesn't recognize or has never invoiced
• Legal escalation ("mediation," "recovery action") with no case details or named contact
• A link to "view" an attachment that isn't attached
• A sign-in prompt after clicking a link in an invitation

How Adaptive caught it

Since the sender and authentication both checked out, Adaptive's agents focused on the content of the request. Three signals fired:

• An unusual request from this sender to this recipient. Our agents flagged that "the calendar-invite framing is inconsistent with the substantive ask, which is invoice collection and escalation."
• A suspicious link in the invitation. As our agents put it, "The generic 'View Attach' CTA conceals a Google-redirected buildin.ai share URL."
• Suspicious language: invoice pressure and legal threats inside a calendar invite. The message "threatens mediation and recovery without identifying an invoice relationship or supplying normal billing details."

Adaptive Email Security classified the email as malicious, with the category Calendar Phishing. Our agents summed up why authentication wasn't enough: it "proves domain control but does not legitimize this deceptive calendar-wrapper and third-party-content pattern; the account may be compromised." Because the email had already been delivered, Adaptive removed it from the inbox and deleted the calendar event it had created, so no reminders would bring the link back.

What to do about it

• Email Security When Adaptive detects a malicious calendar invite it removes it from both the inbox and the users calendar, preventing any interaction with attacker's content.
• Judge the request, not the sender. Passing authentication and an old domain prove nothing when the account is compromised. Treat invitations that carry invoices, payment demands or legal threats like any other email asking for money or credentials, and look for email security that evaluates the request itself, not just the sender's reputation.
• Clean up both places. When a malicious invitation is removed from the inbox, make sure the event it created comes off the calendar too, and reset credentials for anyone who reached the sign-in page.
• Limit automatic calendar adds. Where your platform allows it, set invitations from unknown senders to be added only after the recipient responds, especially for finance, AP and executives. It won't stop compromised known senders, but it cuts the volume.

Adaptive Email Security evaluates what each message asks the recipient to do, and it cleans up the calendar as well as the inbox. See how Adaptive Email Security protects against calendar phishing.