Warning: Attackers Are Tricking Employees Into Sharing Malicious Calendar Invites
KnowBe4, Wednesday, October 7th, 2026
Attackers posing as prospects get employees to forward booking links that lead to Microsoft 365 credential phishing.
KnowBe4 reports on a calendar phishing variant tracked by Fortra researchers in which attackers pose as prospective customers and contact non-sales employees.
The attackers ask to be routed to a sales representative and send a meeting-booking link to be forwarded internally, making the rep more likely to click because it arrives from a trusted colleague.
The booking page then shows a fake Microsoft 365 sign-in prompt, framed as necessary to complete the booking, to harvest credentials.