Calendar Invites Become a Primary Vector for AI-Enhanced Phishing
Calendar invitation scams have surged exponentially, with attacks increasing tenfold in August alone. These schemes exploit the trust users place in calendar entries, using AI to create convincing fake meetings or deepfake video calls. Unlike standard email, calendar invites can auto-accept, bypassing spam filters. Experts warn that AI agents may soon auto-accept these fraudulent invites, while passkeys are cited as the primary defense against credential theft.
Key points
- Sublime Security reports a tenfold surge in calendar-led attacks in August 2026, while Microsoft notes a near-quadrupling in June.
- Scammers use calendar invites to bypass traditional email spam filters, as many platforms auto-accept invitations without user interaction.
- AI enables highly convincing scams, including deepfake video calls and personalized content that mimics internal company communications.
- Victims are often lured to fake login pages or prompted to call fraudulent support numbers to cancel non-existent charges.
- Security experts recommend disabling auto-accept features and adopting passkeys, which cannot be phished, to mitigate these risks.
Background
This trend follows broader concerns about AI-driven fraud in other sectors, such as the rise of fake vacation rental listings reported in September 2026. While those scams targeted consumer trust in booking platforms, calendar phishing targets professional trust and corporate infrastructure, representing a shift toward more sophisticated, automated attack vectors.
How outlets are covering it
Business Insider emphasizes the role of AI in making scams more convincing and warns that AI agents could auto-accept fraudulent invites, creating new vulnerabilities. The Guardian focuses on the technical mechanics, noting that scammers use legitimate platforms like Zoom to bypass security filters and that calendar apps often auto-accept invites without user consent. Both sources agree on the exponential growth of these attacks but differ in their primary mitigation advice: Business Insider highlights passkeys as a structural solution, while The Guardian advises users to manually disable auto-accept settings and remain suspicious of all unexpected invites.
Why it matters
Calendar phishing exploits the inherent trust users place in scheduled events, making it harder to detect than standard email spam. As AI lowers the barrier for creating realistic scams, the risk of credential theft and corporate espionage increases. The potential for AI agents to auto-accept invites could automate the attack process, making manual user vigilance insufficient without structural changes like passkeys.
What to watch
Expect a continued rise in calendar-based phishing as scammers leverage AI to bypass security tools. Organizations should prioritize implementing phishing-resistant authentication like passkeys and review their calendar auto-accept settings. Users should remain vigilant, treating unexpected calendar entries with the same skepticism as unexpected emails.
Want the full story? Read the original reporting
Read on Business Insider