Calendar Phishing Detection and Remediation

A malicious calendar invite doesn't wait for anyone to open it. Google Workspace and Microsoft 365 add invitations to the calendar automatically, so the event lands on an employee's schedule before they've read a word of the email. Removing the email used to leave that event behind with its reminders and its link, which meant security teams had to chase it down calendar by calendar or ask employees to ignore a meeting that kept popping up.

Today, we're launching Calendar Phishing Detection and Remediation, so when Adaptive catches a malicious calendar invite, it takes the event off every recipient's calendar along with the email that delivered it.

What Launched

When Adaptive moves a malicious email to spam, trash, or quarantine, it also deletes the calendar event that email created, so the meeting, its reminders, and its link disappear from the employee's schedule in the same action.

Around that, we've made calendar attacks fully visible across the platform.

• Calendar remediation. Malicious events come off employee calendars automatically in both Google Workspace and Microsoft 365, driven by the remediation rules you already run.
• Calendar Phishing attack type. Calendar Phishing now sits alongside Credential Phishing, Financial Fraud, and the rest of Adaptive's attack taxonomy, so attacks that arrive as invites are classified for exactly what they are.
• Dashboard and reporting visibility. Calendar Phishing has its own count on the Email Security dashboard, shows up in the attack type breakdown, and can be filtered in reporting, so you can see how often your organization is being targeted through the calendar.

• Clear event detail. Every security event marks the calendar attack right next to the verdict and the AI Analysis reasoning that explains why Adaptive flagged it.
• One action, fully reversible. Calendar remediation follows the email, so if you return a message to the inbox, its event returns to the calendar with it.

Why It Matters

Attackers are turning to the calendar more often because a calendar entry feels legitimate. It looks like something a colleague already scheduled, it sits between real meetings, and its reminders bring the employee back to it even after they've ignored the email.

The pretexts fit the format, too. Invites built around an overdue invoice, a payment dispute, or a compliance deadline often come from real, compromised accounts that pass every authentication check. Adaptive judges the request itself instead of the sender's reputation, looking at signals like an unusual ask from that sender, a suspicious link in the event details, and urgent language that has no place in a meeting invite.

Catching the email used to solve only half the problem. An admin who wanted the event gone had to find it on each affected calendar and delete it by hand, or send a note telling employees to ignore an invite that was still on their schedule. Now the same remediation that removes the email removes the event, so there is nothing extra to track down and nothing left behind for an employee to click.

Available Now

Calendar Phishing Detection and Remediation is live now for Adaptive Email Security customers on Google Workspace and Microsoft 365. You'll find Calendar Phishing on your Email Security dashboard and in Security Events, and calendar removal runs with your remediation settings under Settings > Email Security.

If you'd like a walkthrough, get a personalized demo today.