Check Point reported an October surge in calendar phishing

Check Point Research reported that fake calendar invitations were part of a credential-phishing campaign that sent more than 740,000 emails during the first two weeks of October 2026. The campaign’s busiest reported day was October 8, with almost 200,000 emails. CPR said it observed activity through October 15; the figures describe email activity, not confirmed account takeovers. Check Point Research’s October 15 report also says its detection layer flagged more than 302,386 unique phishing emails among its customers’ email, sent to more than 40,000 organizations.

How the calendar lures work

CPR described two routes: a valid .ics calendar-file attachment or a link presented as an invitation. The .ics file is valid calendar data; the reported tactic relies on calendar features and user trust rather than a software vulnerability. Both lures are designed to collect Microsoft account credentials. CPR’s account of the campaign

The figures measure different things: 302,386 is the number of unique messages CPR’s detection layer flagged among its customers’ email, while the October totals describe campaign email activity over a period and on a single day. The reach figure counts organizations receiving messages, not confirmed breaches.

Choose the response for the item you received

For an Outlook.com email, Microsoft says to select the message and choose Report > Report phishing; reporting does not itself block the sender. For calendar items, Microsoft documents a separate reporting button for Outlook for Microsoft 365 subscription builds beginning with version 2512, build 19530.20000. It was initially available in Current Channel Preview and Current Channel, with other Office channels receiving the change as they reach that build or later. Microsoft’s Outlook phishing guidance and classic Outlook calendar-item reporting guidance describe these routes.

Apple’s instructions apply to iPhone with iOS 26 or later. For an unwanted event, choose Delete Event; for an event from an unknown contact, choose Report Junk. If the unwanted entries belong to a calendar subscription, open the calendar list, tap its information button, then choose Delete Calendar or Unsubscribe. Apple’s iPhone Calendar instructions

What a sender address can tell you

Microsoft says Outlook may show a question mark when it cannot authenticate a sender, or a via tag when the actual sending address differs from the displayed From address. Neither indicator alone proves a message is malicious. A displayed address can also be spoofed, so an invitation that appears to come from your own address does not by itself show that your account sent it. Microsoft explains Outlook’s sender indicators and spoofing.

If an unusual-activity email raises a separate concern, Microsoft directs Outlook.com users to check the account’s recent activity page for successful sign-ins and security challenges rather than relying on the email’s link. Microsoft’s account-protection guidance