On October 15, 2026, Check Point published an analysis of campaigns using fake calendar invitations to collect Microsoft credentials. An appointment, sometimes presented as a Teams meeting, gives a fraudulent sign-in link a familiar work context.
For a small team using Outlook and Microsoft 365, the lure sits inside a routine action: joining a meeting. The alert concerns abuse of invitations, rather than a demonstrated software vulnerability in the calendar.
What Check Point observed in October
Check Point reports more than 302,000 unique phishing emails flagged by a detection layer across its customers, sent to more than 40,000 organisations. These figures describe the vendor’s observations. They are not a count of compromised accounts or a global measure of exposed businesses.
The researchers identify a surge beginning September 25 and say activity was still observed on October 15. For small businesses, the practical issue is the delivery format: a meeting request looks like ordinary work.
Valid calendar data can carry an untrustworthy link
The campaigns use .ics attachments or links in invitations impersonating Teams. A correctly formed calendar file can still contain a fraudulent destination. Format validity says nothing about whether the organiser is genuine.
Before following a Join button, check whether you expected the appointment and whether the organiser’s full address fits the context. An unexpected meeting requiring a fresh sign-in should prompt an independent check with the supposed sender.
Why the lure may remain in your calendar
In a separate October 12 analysis, Fortra describes tests where moving an email to Junk or soft-deleting it did not remove the calendar entry. Reminders could continue to display the link. This depends on the client and action taken; it should not be generalised to every configuration.
Fortra also describes variants involving a genuine Microsoft device sign-in code. These should be distinguished from Check Point’s fake-page credential harvesting. Both use a meeting pretext to persuade someone to perform an unexpected authentication step.
When an unexpected invitation arrives
Verify the meeting through an existing conversation or known contact details, rather than details supplied in the suspicious invitation. Open Teams or your usual service independently of the message where appropriate. Do not enter a device sign-in code for a process you did not start.
Report both the email and calendar event to IT. If you followed the link, explain whether you only viewed the page, entered a secret or approved a sign-in. Those differences help determine the response.
For Microsoft 365 administrators
Response procedures should locate the original message and associated event, including copies sent to other recipients. Inbox-only cleanup may leave active reminders in the configurations described by Fortra.
After an interaction, review sign-ins and account permissions. Address suspicious sessions or grants using your environment’s controls; do not assume a password change covers every scenario. Include specific fake Teams appointments in staff awareness examples.
How Soclyde relates to this case
A Microsoft 365 account can provide access to a small company’s email and documents. Soclyde helps assign it a distinct password and keep that secret in an encrypted vault on your devices, reducing reuse across services.
That organisation does not replace meeting verification or Microsoft session analysis. Soclyde does not remove malicious invitations or revoke permissions in a Microsoft 365 tenant.
Key points
Calendar invitations need scrutiny even after they appear in your schedule. Verify the context before signing in and report unexpected approvals. For help organising distinct secrets, see our secure password generator guide.
