That Calendar Invite Could Be Phishing: How New Lures Get Past MFA

Nov 9

How many calendar invites did you accept last week? Most of us click "Yes" on a meeting without much thought, and plenty of invites land on the calendar before we've even looked at them.

Two phishing campaigns reported in the past week use that habit to get around multi-factor authentication (MFA) on Google Workspace and Microsoft 365 accounts.

In October we covered what attackers do once they have a stolen Microsoft 365 session in MFA Was On. They Got In Anyway. This post is about the front end: how they get people to hand that session over.

What's Going On

Material Security has tracked a campaign since mid-August 2026 that starts with a Google Calendar invite. The invites are sometimes sent by BCC and often come from an organization the recipient has traded email with before. The topics are boring on purpose: voicemail notices, RFP and RFI requests, court summonses, missed payment notices. Material says it has taken down 897 domains tied to the operation.

On November 5, Push Security described a second campaign built around fake event registration pages for OpenAI, SpaceX and Anthropic. The pages promise rewards such as three months of ChatGPT Pro and say you need a work account to register. Push first saw the current pages in late October, and the attackers aimed them at marketing staff.

The attackers in both cases want a live, signed-in session, and they have found ways to slip past the link checks most of us count on.

How the Attack Actually Happens

Step 1: The invite arrives. In Material's campaign, it's a calendar invite. Material notes that email security gateways are built to inspect mail as it passes through, and a calendar invite doesn't fit that model well. Push wasn't able to say exactly how the fake-event links were first sent out; earlier versions came through GoTo Webinar's mail sender or real Zoom event pages.

Step 2: The link really is Google. The calendar campaign mostly uses Google's own redirect links, share.google links and Google Drive file links, with the real destination tucked inside. The fake-event campaign used Google short links (c.gle and share.google), Zapier's zpr.io, and in one case an x.com logout redirect. So when a filter checks the domain, the certificate and the reputation, everything comes back clean.

Step 3: A "confirm you're human" page. Both campaigns put a Cloudflare challenge in front of the phishing page. Automated scanners mostly stop there, so the page behind it rarely gets examined.

Step 4: You sign in, and the attacker gets the session. This happens one of two ways.

A live proxy of the Google sign-in page. You type your password and get a real MFA prompt from Google, and the proxy passes everything through as it happens. Material says SMS codes, authenticator codes, Google's Tap-Yes prompt and phone-based account recovery all get relayed. The attacker ends up holding your signed-in session.
A Microsoft device code. On the fake event page, "Continue with Microsoft" shows a short code and a button that opens Microsoft's real device login page. You paste the code, sign in and approve. Microsoft then issues the sign-in tokens to the attacker's session instead of yours. Push says the page then sends you to a fake Microsoft sign-in that grabs your password and session cookie as well.

Step 5: The attacker goes to work. A live Google session reaches mail, Drive and the ability to grant apps access in your name. BleepingComputer notes that device code tokens can reach Microsoft 365 and other apps connected through single sign-on.

Who They're Targeting

Anyone with a work account. The calendar campaign targets corporate users broadly, and the fake AI events are aimed at people who'd want free AI tools, which these days is most of your staff. For an Arkansas small business, that might be the owner or the office manager. In a school district it could be the business office, a principal or the tech coordinator. At a church, it's whoever runs the office email.

Phishing is already the most common incident Arkansas schools report. Arkansas Legislative Audit's latest annual report lists 94 cybersecurity incidents reported by school districts for July 2024 through June 2025. Forty were spam or phishing attacks and 13 were business email compromise. (These are self-reported numbers that ALA didn't audit, and none are tied to these campaigns.)

One taken-over account rarely stays one account. In British Columbia, Central Okanagan Public Schools shut off Gmail for all staff and students on October 30 after four district accounts were used to send about 3,000 phishing emails to people inside the district. The district hasn't said how those accounts were compromised, and nothing ties that breach to these campaigns.

How to Stop It

For everyone on staff:

Be wary of any calendar invite you weren't expecting that wants you to click a link, especially about voicemail, payments, contracts or legal notices. Verify it with the sender using contact info you already have.
A link that starts with Google, Zapier or X can still send you somewhere bad.
Never type a device code that came from a website, email or invite. Legitimate device codes come from a device you're setting up yourself, such as a TV or a conference room screen.
Free AI subscriptions that require your work login are a red flag.

For whoever runs IT:

Block Microsoft device code sign-in with Conditional Access. Microsoft recommends getting "as close as possible to a unilateral block" and allowing it only for documented needs. Start in report-only mode to see who uses it.
In Google Workspace, limit which invitations get added to calendars automatically. Since August 2026, admins can set the least restrictive option users can choose, such as invitations from known senders only. Material's invites often came from organizations the recipient knew, so treat this as one layer among several.
Move your admins, finance, payroll and anyone handling student data to phishing-resistant MFA such as FIDO2 security keys or passkeys. CISA calls it "the gold standard" because it holds up against phishing.
Watch sign-in logs and new app (OAuth) grants, and practice revoking sessions. Material asks a fair question: could your team revoke sessions, contain app grants and reset an account within an hour?

Would Your Organization Catch It?

If your bookkeeper got a "missed payment" calendar invite tomorrow, would they click it?
Is device code sign-in turned off in your Microsoft 365 tenant, or do you not know?
Who reviews sign-ins and new app permissions in Google Workspace or Microsoft 365, and how often?
If a staff account started sending phishing emails at 7 a.m., how long before someone noticed and shut it down?
Do your highest-risk people have phishing-resistant MFA, or a text message code?

If you're not sure about two or more of these, that's a good place to start.

How Red Garrison Can Help

Jeremy and I spent years running technology for Arkansas schools, so we know how stretched most IT teams are. We look at your setup the way an attacker would and then help you close the gaps.

Our Microsoft 365 Security Assessment checks your Conditional Access, device code settings, MFA methods and app consent, then gives you a short list of what to fix first.
Huntress-powered ITDR (identity threat detection and response) for Microsoft 365 and Google Workspace watches sign-ins and account changes around the clock, with people who respond when a session looks hijacked. It's part of our managed security for small businesses and for K-12 and higher ed, along with security awareness training that shows staff what these lures look like.
Incident Assist helps if you think an account was already taken over. Assessments start at $199 for individuals and $750 for organizations.
You can see how our services are priced on our pricing page.

Let's Check Your Sign-Ins

Schedule a free assessment this week. We'll walk through how your Google Workspace or Microsoft 365 sign-ins are protected, check whether device code sign-in is open, and tell you plainly what we'd lock down first. Prefer the phone? Call us at (501) 404-5966.

We think like attackers. We work like partners.