Scammers are using calendar invite files to put fake meetings on your calendar, and one scam led to remote access to a victim's computer.
A fake calendar invite can land on your calendar before you ever open it. Gmail, Outlook and Apple Mail can add an invite automatically, before you accept or decline. Scammers are taking advantage. Cybersecurity firm Sublime says these scams have increased exponentially over the last few months.
The trick is called ICS phishing. An ICS file is the small file inside an email that holds the details of a meeting. Email programs read it and add the event to your calendar. Because the event just appears, it can look routine, and a link inside it can look like part of a real meeting.
One attack Sublime described used a Google Calendar invite sent from a Gmail account. The message offered a supposed credit on a recent invoice and invited the person to a meeting to talk about it. Because it came from a Gmail account, it would not have been blocked based on the domain.
Clicking the link leads to a page hosted by Framer, which offers a free hosting plan. The page asks you to click a View Here button to get the credit note. That button actually downloads a malicious installation file. It sets up ScreenConnect, a legitimate remote access tool, so that attackers can send commands to the infected computer.
Even a security block on the email may not help. According to the report, if the email were stopped, the event would still end up on the target's calendar.
Anyone who uses Gmail, Outlook or Apple Mail could see one of these invites. Small businesses that handle invoices and payment emails are an obvious target, since the example used a fake invoice credit. A hijacked work computer can put company money and files at risk.
John Gallagher of Viakoo said the attacker is assuming default settings are in place. People who have already changed the auto-add setting are less exposed to the invite appearing on its own.
The steps in the alert box above cover the basics. One point is worth repeating. Shane Barney of Keeper Security warns that even clicking Decline tells the sender your email address is active, which can invite more attempts.
The settings change takes a minute. In Gmail, it lives in Google Calendar settings under Event Settings. Choose "Only if the sender is known" or, better, "When I respond to the invitation in email." Classic Outlook has two boxes to uncheck, one in Mail options and one in Calendar options. The source did not give steps for Apple Mail.
Be wary of any meeting you did not expect, especially one that mentions an invoice, a credit or a payment. Treat links and QR codes in an invite the same way you would in a suspicious email. If you or an employee already clicked and downloaded a file, the source does not say how to clean up, so that is a case for your IT support.
Turn off automatic adding of calendar invites, and never click, accept or decline a meeting you did not expect.
Morristown police say scammers posing as bank staff are pushing people to withdraw cash, which is very hard to get back once it is handed over.
Read more: Morristown police warn of scam where fake bank staff ask for cashA viral ChatGPT prompt turns what the chatbot remembers about you into a room image. Posting it publicly could give scammers clues to target you.
Read more: Viral ChatGPT room image could hand scammers clues about youA message saying your Amazon account was hacked is often the scam itself. Checking in the Amazon app first can protect your card, gift balance and phone.
Read more: If Amazon says your account was hacked, check before you call
