Calendar invitations used by office workers are being abused as a new channel for phishing attacks. The tactic disguises itself as a normal meeting schedule to prompt clicks on malicious links and the entry of personal information. With AI deepfakes also being used, concerns over potential damage are growing.

On Oct. 12 (local time), Business Insider reported that calendar-based attacks detected by email security firm Sublime surged 1,216 percent in August from the previous month, about a 13-fold increase. Microsoft also said in June that malicious files in the form of calendar invitations rose 277 percent from the prior month.

Hackers exploit the fact that office workers naturally accept meeting invitations from colleagues or clients. In particular, calendar invitations are handled differently from typical email attachments, allowing a malicious link to be added to a schedule even if the user does not open a file directly.

Attack methods also vary. A common approach is inserting links to phishing sites or malware downloads into fake meeting invitations. Another tactic has emerged in which attackers use an actual employee's name and AI-generated voice and video to pose as a credible person in a video meeting.

Aman Gairola (아만 가이롤라), co-founder of Indian design firm Say Design, found in June that a Google Drive link in a meeting invitation sent by a potential customer led to a fake site. By checking the address, he was able to avoid downloading a file.

Cases have also been confirmed in which attackers strike after taking over an acquaintance's account. After mountaineer Jenn Drummond (젠 드러먼드)'s email account was hacked, calendar invitations impersonating court summonses were sent to acquaintances. The link led to a fake legal notice that requested financial information.

Experts warned that a feature in which AI agents accept invitations on behalf of users could also become a new security risk.

Security firm Okta said it is difficult to block sophisticated phishing through user caution alone and recommended adopting passkeys. Passkeys can reduce the risk of authentication information being stolen on fake login sites by linking to the actual service domain.