Incident Response
Calendar Invite Phishing: Microsoft 365 Response Checklist
Respond to fake Outlook and Teams invitations: preserve calendar evidence, investigate credential exposure, contain compromised accounts, and verify cleanup.
Updated 2026-10-19 · 3 min read
Evidence
Preserve the invitation
Capture the original message, calendar attachment, event identifier, and destination URLs.
Exposure
Establish what the user did
Separate delivery, acceptance, link opening, and credential submission.
Cleanup
Check both mail and calendar
Verify removal of matching messages, events, and recurring instances.
Useful CyberPrism references
Check Point: Fake calendar invitation campaigns
October 15, 2026 research on Microsoft credential phishing through meeting invitations.
Microsoft account recovery guidance
Contain compromised accounts and inspect authentication and mailbox persistence.
CyberPrism RIPD Framework
Connect investigation findings with defensive priorities.
How should you respond to calendar invite phishing?
Preserve the invitation, establish whether the recipient followed its link or entered credentials, and inspect both the mailbox and calendar for matching items. If credentials were submitted or unauthorized access is detected, begin account containment immediately.
On October 15, 2026, Check Point reported campaigns using .ics attachments and deceptive meeting links to steal Microsoft credentials. Its findings give security teams a timely reason to review calendar handling as of October 19; the described attachment technique abuses valid calendar data without requiring a software vulnerability. [Check Point research](https://blog.checkpoint.com/securing-user-and-access/fake-calendar-invites-target-thousands-of-organizations-in-microsoft-credential-phishing-campaign/).
Preserve the message and calendar evidence
Save the original message with headers and any .ics attachment before cleanup. Record the recipient, delivery time, organizer address, event title, event UID where available, recurrence details, and embedded URLs.
Ask the recipient what happened: invitation received, accepted, link opened, password entered, or authentication prompt approved. Record approximate times and inspect suspicious destinations through your security tooling rather than opening them from a production account.
Scope exposure beyond the first recipient
Search available mail and security logs for matching URLs, organizer addresses, subjects, and attachment indicators. Use multiple attributes together so a common meeting title does not drive unrelated deletions.
Correlate reported interactions with sign-in and audit records around the same time. Keep delivered invitations, reported clicks, credential submissions, and confirmed unauthorized activity as separate findings; accepting a meeting alone does not establish account takeover.
Contain compromised accounts and inspect persistence
For compromised accounts, disable access, revoke sign-in sessions, and reset exposed passwords through the appropriate identity system. Review registered authentication methods, application consent, assigned roles, mailbox forwarding, and inbox rules for unauthorized changes. [Microsoft recovery guidance](https://learn.microsoft.com/en-us/defender-office-365/responding-to-a-compromised-email-account).
Verify that containment took effect. Revocation can have delays, and applications may control their own session cookies; an administrator submitting a revocation request is not proof that every session has ended. [Microsoft access revocation guidance](https://learn.microsoft.com/en-us/entra/identity/users/users-revoke-access).
Verify calendar cleanup and close with evidence
After preserving evidence, remove confirmed malicious messages and inspect affected calendars for matching events, recurring instances, and reminders. Verify the result in the clients your organization uses instead of assuming email removal also cleaned the calendar.
Test reporting and cleanup with a harmless sample invitation. Give employees one clear instruction: report unexpected meeting requests through the established security channel and verify the organizer through a known contact method before using embedded sign-in links.
Close the incident with affected recipients, observed interactions, account actions, calendar cleanup results, and unresolved logging gaps. Assign an owner and deadline to each remaining action using your [RIPD workflow](/ripd).
FAQ
Is calendar invite phishing a Microsoft vulnerability?
The technique described in Check Point's October 15 report uses valid calendar data and deceptive links rather than a software vulnerability. Investigate the invitation and account activity instead of assuming there is a CVE to patch. [Check Point findings](https://blog.checkpoint.com/securing-user-and-access/fake-calendar-invites-target-thousands-of-organizations-in-microsoft-credential-phishing-campaign/).
Should every recipient of a fake invitation reset their password?
Receipt alone does not establish credential exposure. Determine whether the user submitted credentials or completed an unexpected authentication request, and review activity; prioritize containment when exposure or unauthorized access is identified.
Try CyberPrism
Track CVEs, threat actors, breaches, ransomware activity, and vendor exposure from a mobile-first cybersecurity app.