News·Oct 13, 2026
Calendar phishing scams surge 33,000% in four months, cybersecurity firm finds
ICS-based attacks sneak malicious meeting invites past spam filters, targeting salespeople and recruiters who meet with strangers.
Phishing attacks that use calendar invite files, known as ICS phishing, rose roughly 33,000% between May and September, according to cybersecurity firm Sublime, as reported by Morning Brew.
The scam works because calendar invites can slip malicious links past spam filters without requiring the target to open an attachment, making it especially effective against salespeople and recruiters who regularly take meetings with strangers.
Sublime identified three main tactics: links that lead to a fake login form, prompts to download malware, or an actual meeting with a scammer posing as a trustworthy contact, such as an employee at another company.
One driver, per Sublime, is AI agents accepting calendar invitations on a worker's behalf without human review. Consumer Affairs recommends checking calendar settings to avoid automatically adding every incoming invite.
Free tool
Make your family’s safe word
A cloned voice can sound exactly like your child or parent, but it can’t know a phrase only your family shares. Make one here, send it to your family, and ask for it on any call about an emergency or money.
Made on your device and never saved or sent to us. Best of all: share it in person, and never post it online.
Already sent money?
What to do in the first hour
- Bank transfer or Zelle
- Call your bank or credit union right away, say it was a scam, and ask them to reverse the payment.
- Wire transfer (Western Union, MoneyGram, Ria)
- Call the company immediately, report the transfer as fraud and ask for a reversal. If the money hasn't been picked up yet, it may still be stopped.
- Gift cards
- Contact the company that issued the card, tell them it was used in a scam and ask for a refund. Keep the card and the receipt.
- Cryptocurrency
- Contact the exchange or crypto ATM company you used and ask if it can be reversed. Crypto payments usually can't be, so report it quickly.
- Cash handed to a courier or mailed
- Call your local police. If you mailed it, contact the shipping company right away to try to stop the package.
Then report it to the FBI at ic3.gov and the FTC at ReportFraud.ftc.gov. For free one-on-one help, AARP’s Fraud Watch Network Helpline is 877-908-3360 (weekdays, 8 a.m. to 8 p.m. ET, open to non-members).
Make your voice harder to clone
4 settings to change today
- Switch to the default voicemail greeting. A recorded greeting in your own voice is free audio for anyone who calls your number.
- Make family videos private. Clones are built from clips posted publicly. Limit who can see videos where you or your kids talk.
- Skip voice ID at your bank. If your bank lets you log in with your voice, ask for a PIN or app-based check instead.
- Don't chat with unknown callers. If a stranger keeps you talking with no clear reason, hang up.
More ways to protect yourself.
From NetWorthy
Every story, one email, 8am daily.
Subscribe at the bottom of this page.