Kapersky Researchers Warn Google Calendar Users Against New Phishing Attacks

Kapersky Researchers Warn Google Calendar Users Against New Phishing Attacks

Kapersky security researchers have identified a new phishing attack that takes place in Google Calendar. Threat actors send a Google Calendar invitation to a user that contains a malicious link hosting a phishing URL.

Security researchers at Kapersky recently warned Google Calendar users that they may be targeted with a credential-stealing attack by threat actors.

When performing this attack, the threat actors will send a calendar invitation to a user. Unfortunately, that calendar invitation hosts a malicious link to a phishing URL. If the user clicks on the link, the website reached will ask victims to enter their credit card details and add some personal information. The website says that upon completion, the user will win prize money, but instead, the information is delivered to a scammer.

Maria Vergelis, a security researcher at Kaspersky said that the “calendar scam” has the potential to be effective and dangerous, given the fact users are used to receiving phishing attacks through email or messaging apps, not their calendar app. She also said that at the current moment though, the scam would need to become more elaborate to be overly convincing.

“But this may not be the case when it comes to the Calendar app, which has a main purpose to organize information rather than transfer it,” Vergelis said. “So far, the sample we’ve seen contains text displaying an obviously weird offer, but as it happens, every simple scheme becomes more elaborate and trickier with time.”

Luckily, the app feature that allows scammers to attempt this form of phishing can be easily disabled.

Kapersky researchers advise to “Turn off the automatic adding of invitations to your calendar. To do so, open Google Calendar, click the settings Gear Icon, then on Event Settings. For the ‘automatically add invitations’ option, click on the dropdown menu and select ‘No, only show invitations to which I’ve responded’. Below this, in the View Options section, make sure ‘Show declined events’ is NOT checked, unless you specifically wish to view these.”

Although the scam is not highly developed yet, it still poses a serious risk to those who could fall victim to the attack. In addition, the attack has room to grow into a much more convincible and less obvious threat.

About the Author

Kaitlyn DeHaven is the Associate Content Editor for the Infrastructure Solutions Group at 1105 Media.


  • Live From ISC West 2023: Day 1

    ISC West 2023 in Las Vegas, Nevada, has officially begun! Make sure to keep an eye on Security Today’s ISCW Live 2023 page, as well as our associated Twitter accounts—@SecurToday and @CampusSecur—for the latest updates from the show floor at the Venetian Expo. Read Now

    • Industry Events
    • ISC West
  • It Happened Again

    Just yesterday (as of this writing), it happened again. A 28-year-old woman shot her way into a Christian elementary school in Nashville, Tenn., on Monday and killed three children and three adults, according to national news. AP News reports that the victims were three 9-year-old children, a top school administrator, a substitute teacher, and a school custodian Read Now

  • Let's Get to Work

    You are standing at the conference center doors just waiting to get into the exhibit hall. I know you are because I’m standing next to you. This week at ISC West has been three years in the making. Last year was encouraging, and here we are waiting for the Big Show. Read Now

    • Industry Events
    • ISC West
  • Using Modern Technology

    Using Modern Technology

    Workplace violence is a serious and growing challenge for many organizations — including those in the healthcare industry. Read Now

Featured Cybersecurity

New Products

  • ALTO Neoxx Electronic Padlock

    ALTO Neoxx Electronic Padlock

    Built to withstand all access control needs, the tough new SALTO Neoxx electronic padlock takes security beyond your expectations. 3

  • PDK IO Access Control Software

    PDK.IO Access Control Software

    ProdataKey now allows for "custom fields" within the interface of its pdk.io software. Custom fields increase PDK's solutions' overall functionality by allowing administrators to include a wide range of pertinent data associated with each user. 3

  • LenelS2 BlueDiamond™ mobile app

    enelS2 has introduced its Indoor Location subscription-based service for businesses and other organizations using LenelS2’s BlueDiamond™ mobile app version 2.1.8 for smartphones. 3