Massive Fake Calendar Invite Campaign Targets Over 40,000 Companies for Microsoft Credential Harvesting

A coordinated phishing operation has flooded more than 40,000 organizations with counterfeit calendar invitations that masquerade as legitimate meeting requests, aiming to capture Microsoft account usernames and passwords.

The invitations typically arrive via Outlook or Teams, displaying familiar branding and a brief agenda. When recipients click the embedded link, they are redirected to a replica Microsoft sign‑in page that records their credentials before forwarding them to the real service, allowing the attacker to obtain valid login details without alerting the user.

Security analysts who first reported the campaign, citing the cybersecurity outlet Hackread, say the scale of the distribution suggests a well‑resourced group leveraging compromised email lists or automated harvesting tools. Similar tactics have been observed in past months, reflecting a broader trend of attackers exploiting the trust placed in calendar invites to bypass traditional email‑filter defenses.

Successful credential theft can give threat actors unfettered access to an organization’s Microsoft 365 environment, including email, Teams chats, SharePoint files, and other cloud resources. Such access often serves as a foothold for further intrusion, data exfiltration, or the deployment of ransomware, amplifying the potential damage beyond the initial login compromise.

Experts recommend that administrators educate users to verify meeting requests through alternate channels, scrutinize URLs for subtle misspellings, and enforce multi‑factor authentication (MFA) across all Microsoft accounts. IT teams are also urged to monitor for anomalous sign‑in activity, especially from unfamiliar locations or devices, and to apply conditional access policies that limit risky behavior.

The incident underscores the growing attractiveness of Microsoft 365 as a target; its ubiquity in corporate workflows makes it a high‑value asset for cybercriminals. As organizations continue to adopt hybrid work models, the reliance on calendar and collaboration tools is likely to increase, offering attackers more opportunities to embed malicious links in everyday communications.

Microsoft has not yet issued a dedicated advisory, but the company routinely updates its security guidance and encourages customers to adopt its zero‑trust framework. Law enforcement agencies are reportedly investigating the source of the campaign, and security firms are monitoring for related indicators of compromise to help organizations detect and remediate any affected accounts.