How It Really Happened: "Calendar Con"
Calendar Con
Security Topic: Calendar Invite Phishing
NINJIO Season 11: Episode 10
A hacker, played by David Shatraw, uses a compromised employee account and a spoofed, urgent-looking calendar invite to target Nexstar’s CFO, exploiting how easily people trust meeting requests that look routine and internal. The episode highlights how attackers weaponize familiar formatting, urgency, obedience, and busy schedules to trick users into clicking malicious links
Teachable Takeaways
- Calendar invites aren’t automatically safe. Attackers know people trust them, whichmakes spoofed meeting requests an easy way for hackers to scam people.
- Busy schedules create blind spots. Attackers intentionally target moments when usersare multitasking and overly busy.
- Familiar formatting can be faked. Logos, signatures, and internal language can all becopied to make them look real. Verify invites through a separate, trusted channel.
Additional Reading
- Apple users beware – hackers crack iCloud Calendar invites to sneak malware onto your system, here’s how to stay safe – Tech Radar
- Calendar Phishing Scams – Boston College
- iCloud Calendar abused to send phishing emails from Apple’s servers – Bleeping Computer
- Cyber Alert: Phishing Scams Using Google Calendar Invites – Berkley Labs
- How to Prevent Spam Events on Your Google Calendar – Brown University
- Ongoing phishing attack abuses Google Calendar to bypass spam filters – Bleeping Computer
- Fake Invites Dupe Outlook And Google Calendar Users – Bank of North Dakota
About NINJIO
NINJIO reduces human-based cybersecurity risk through engaging training, personalized testing, and insightful reporting. Our multi-pronged approach to training focuses on the latest attack vectors to build employee knowledge and the behavioral science behind human engineering to sharpen users’ intuition. The proprietary NINJIO Risk Algorithm™ identifies users’ social engineering vulnerabilities based on NINJIO PHISH3D phishing simulation data and informs content delivery to provide a personalized experience that changes individual behavior.
