Calendar-Based Malware Attacks Surge by 2,852% in September
ICS phishing exploits default calendar settings to deliver malicious payloads via trusted invites.
1Alarming attack surge
Sublime Security reports a 1,216% increase in calendar-based malware attacks in August 2023, with projections showing a 2,852% spike in September. These ICS phishing attacks leverage iCalendar standard files that automatically populate calendars in Outlook, Gmail, and Apple Mail before user consent. The attacks bypass traditional email security by appearing as legitimate calendar entries rather than suspicious emails.
2Trust exploitation mechanism
Attackers exploit implied trust in calendar systems and default settings where invites auto-populate. Viakoo's John Gallagher notes calendar invites aren't as suspect as email phishing. Even rejecting invites confirms email validity to attackers. The technique uses ICS files containing meeting details that bypass security scans when domains appear legitimate, like Gmail accounts.
3RMM payload delivery
One attack vector delivers Remote Monitoring and Management malware via Google Calendar invites. The email lures victims with fake credit notes against invoices. Clicking 'View Here' on Framer-hosted pages downloads malicious MSI files. These files configure ScreenConnect remote access tools as Command and Control servers, enabling system exploitation.
4Financial lure tactics
Attackers use financial incentives like invoice credits to increase click-through rates. The fake meeting invites appear from non-blocked domains, automatically landing in calendars regardless of email security. Even if blocked by email filters, the calendar entry persists, maintaining the attack vector until manually deleted.
5Enterprise risk factors
Keeper Security's Shane Barney warns against any interaction with suspicious invites—including declining them—as it validates email addresses. The attacks particularly threaten enterprises where calendar sharing is common. Default settings in corporate email clients create widespread vulnerability to these auto-populating malicious events.
6Gmail protection steps
In Google Calendar, navigate to Settings → Event Settings to change 'Add invitations to my calendar' to 'Only if the sender is known' or 'When I respond'. This prevents automatic calendar population from unknown senders. The setting change is crucial as 63% of attacks originate from seemingly legitimate domains like Gmail according to Sublime's data.
7Outlook configuration
For Outlook, disable automatic processing in File → Options → Mail by unchecking 'Automatically process meeting requests'. In Calendar options, turn off 'Automatically accept meeting requests'. These steps prevent malicious ICS files from creating calendar entries without user approval, closing a major attack vector.
8Incident response protocol
Security teams should treat calendar invites with the same scrutiny as emails. Sublime's Mark Morris recommends immediately deleting suspicious events and reporting as spam. Organizations must update security training to include calendar-based threats and implement policies restricting automatic calendar updates from external domains.
Original article: Latest news — Calendar-Based Malware Attacks Surge by 2,852% in September