b'THE OFFICIAL NFBA MAGAZINECALENDAR INVITATION PHISHINGCYBER SECURITYBy: Jack GerbsQuanexusC riminals are using calendar invitations to launcheven more convincing now that virtual phishing attacks and break through emailmeetings are the norm in the workplace, filtering. Last year, we saw a new phishing tacticand employees are regularly invited to used against the corporate world to steal employeesunusual virtual meetings.login credentials. Criminals used compromised emailThe tactic was used extensively in the first part of the addresses to send employees meeting invites withyear against personal user accounts to the extent that malicious links in the body of the invitation disguisedGoogle took action and added calendar invitations to as a virtual meeting link. The attack vector has recentlytheir list of automatically filtered spam. Users can also worked its way down to individuals at such a rate thatchange account settings so only calendar invitations Google had to take action last month. from known contacts automatically appear on their Many phishing attacks use Microsoft documents orcalendar. Calendar invitations from unknown users PDFs as part of the attack because they will typicallywill still appear in the users email inbox but will not be make it through email filtering. A calendar invite attackadded to the calendar without accepting the invitation.uses an ICS file for the same reason. Some email clients will even add a calendar invite to a users calendar before they respond to the invite. The attacks are 24 / FRAME BUILDER - MAY2023'