Sublime Security said attacks sent as calendar invites have surged since August. Help Net Security reported on 20 October that Sublime saw the first half of September run 1,426% above all of August. Check Point said these emails grew from a few thousand in April to over 118,000 in September. It put the first two weeks of October at over 740,000. Sublime's example was a Google Calendar invite from a Gmail account with a fake payment lure. Its link led to a Framer page offering a ScreenConnect installer of about 10MB.
Sublime said most email security tools only stop these attacks in the inbox, not the calendar. Email and calendars run on different protocols, so an invite can reach the calendar even after the email is caught, and, depending on settings, may be added automatically. Sublime said a free Gmail sender gets cover from denylists (lists of banned senders). The invite comes over trusted Google systems, and Google rewrites its links to pass through google.com. Each step used free tools. The sources do not say how many people got that invite or who is behind the attacks.
So quarantine may not end the threat. Help Net advised security teams to check that their tools cover calendar entries and remove the linked event. Does yours?