Fake Meeting Invites Are Phishing for Microsoft 365 Logins at Scale: Each Step of the Lure, Matched to a Defense

Here Is How Layered Defenses Help When a Calendar Invite Is the Phishing Lure

Nobody thinks twice about a meeting invitation. It shows up, you glance at the time, you click accept. That reflex is exactly what a fast-growing wave of phishing is counting on, and it is aimed squarely at Microsoft 365 accounts.

The numbers come from Check Point’s email research team, which published its findings on October 15, with added detail from TechRadar’s write-up.

The scale

A sharp surge began on September 25, 2026.
A detection layer Check Point built for this trick flagged more than 302,386 unique phishing emails in its customers’ mail, sent to more than 40,000 organizations, averaging more than 8,319 a day on active days.
The messages came from more than 33,890 sender domains and 247,270 sender addresses. TechRadar reports they were sent from compromised email accounts.
Volume went from a few thousand a month in April to more than 118,000 in September and more than 740,000 in the first two weeks of October. The single busiest day was October 8, with almost 200,000.
Activity was still being seen on October 15. Note that these are organizations targeted, not confirmed breaches.

The lure, step by step, and the layer that answers each step

Step 1: The message arrives from a real-looking sender

With tens of thousands of sending domains and many hijacked mailboxes, blocking by sender alone does little. Layer: email filtering that judges content and links, not just reputation, plus clear “external sender” tagging so staff can see when an invite came from outside the company.

Step 2: The invite slips past the filter

Some versions arrive as an .ics calendar file. It is valid calendar data, not malware, so filters tend to let it through, and depending on a user’s settings the event may be added to the calendar automatically. Others arrive as a link. Layer: calendar settings. Check whether your mail platform automatically adds invitations from outside senders to calendars, and whether you can switch that off or limit it for external mail.

Step 3: The hook sits inside the event

The malicious link hides in the event description, the location field or an embedded QR code. In one example Check Point shared, a fake Microsoft Teams invite’s “Join” button led to a credential-harvesting page rather than a meeting. Some lures pose as payment notices instead. Layer: link protection that checks a destination at the moment of the click, DNS filtering that blocks newly registered or known-bad domains, and a simple habit for staff: join meetings from inside the Teams or Outlook app, never from a link in an unexpected invite, and treat QR codes in work email as suspicious.

Step 4: A fake sign-in page asks for the password

The landing page imitates a Microsoft 365 login. Layer: phishing-resistant sign-in. Passkeys or hardware security keys will not work on a look-alike site, which makes a typed password far less useful to an attacker. Codes sent by text or approved in an app are better than a password alone, but some phishing kits can relay them in real time. Conditional access rules that require a managed device or a known location add another barrier.

Step 5: Someone signs in who shouldn’t

Layer: detection and fast response. Alert on sign-ins from unfamiliar locations or devices, on new inbox forwarding rules, and on new MFA methods being registered. Know in advance who can reset a password and end every active session within minutes, because that is what limits the damage when one invite gets through.

Tools are examples, not the answer

Products such as Microsoft Defender for Office 365’s link and attachment checks, a third-party secure email gateway, a DNS filtering service or Microsoft Entra conditional access can each cover one of the layers above. None of them covers all five. The protection comes from stacking them so that a lure that beats one layer meets the next.

What this means for your company

This campaign uses no software flaw and no malware, so there is nothing to patch. It works on habits and default settings. Spend a few minutes at your next staff meeting showing what a fake invite looks like and how to join a real meeting safely, ask whoever runs your Microsoft 365 tenant whether outside invitations are auto-added to calendars, and make phishing-resistant sign-in the goal for anyone with access to email, finance or admin settings.

Need help tuning your email, calendar and Microsoft 365 sign-in protections against lures like these? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.