Someone you have never met sends you a meeting invite. The subject line is dull and work-shaped: "Quick sync on the order." There is a Teams link and a time. You accept it, the way you accept the other forty things that land in your inbox before lunch.
That is the whole attack.
On October 15, Check Point Research published findings on a phishing campaign built almost entirely out of fake calendar invites. Activity jumped on September 25 and has not stopped. Their detection layer flagged more than 302,000 unique phishing emails sent to more than 40,000 organizations, an average of 8,319 per active day, coming from roughly 33,890 sender domains and 247,270 sender addresses. The campaign was still running on the day they published.
Nothing is broken, which is the problem
There is no software flaw here. No unpatched server, no bad update, nothing your IT person failed to install. The attackers are using the calendar the way it was designed to be used.
Some invites arrive with an .ics attachment. That is a real calendar file. It opens the way calendar files open, and it adds a real-looking meeting to your calendar. Other invites carry a "Join" link that reads like Teams and lands on a page built to look like the Microsoft sign-in screen. Hover over the link and the real destination is usually something else entirely.
This works because meeting invites are the one kind of email we do not interrogate. You get invites from customers, vendors, recruiters, and people whose names you half recognize. Refusing all of them is not an option in a business that wants to keep working.
So the attackers did not need to fool you. They only needed volume. Nearly 34,000 sender domains is not a targeted attack on your shop. It is a net dragged through the whole ocean, and small businesses swim in it.
A rule that covers every version of this
If a link asks you to sign in to Microsoft, stop. Close it.
Then open Outlook or Teams yourself, from the icon on your desktop or the app on your phone, and look at your calendar. If the meeting is real, it is already there. A genuine invite does not require you to prove who you are. The meeting exists whether or not you log in again.
If you would rather not hunt for the icon, type office.com into the address bar yourself. Same for Teams. The address you typed is the address you get. That is the entire defense.
One more check that costs nothing: your password manager will not fill in your Microsoft password on a page that is not Microsoft. If autofill stays silent, that silence is information. Close the tab.
If you already typed it in
Tell someone. Today. The embarrassment lasts about ten minutes and it is much cheaper than the alternative.
Then, in order: change your Microsoft password from a different device, sign out of all active sessions so the old login stops working, and have whoever handles your IT check the mailbox for forwarding rules and rules that quietly move messages into a folder you never open. Attackers who get into a mailbox usually leave something behind so they can keep reading after you change the password. Those rules are how they do it. They are also easy to miss and easy to remove once someone looks.
The person who reports a mistake in ten minutes is worth more to a business than the person who hides it for two days. Every honest security conversation I have had with an owner comes back to that. Speed beats shame.
What actually helps this week
Turn on multifactor authentication for every Microsoft account in the business, including the ones nobody thinks about: the shared inbox for invoices, the account the bookkeeper uses, the owner's account. A fake sign-in page does not need to defeat that code. It just asks you for it, and people type it in because the page looks right. MFA is still worth having. It is not a reason to trust a link.
Then tell your staff one sentence, out loud, in a meeting: if a link asks you to sign in, close it and open the app instead. That sentence handles the calendar invites, the fake voicemail notices, the "shared document" emails, and whatever version of this shows up next month.
You do not need new software for most of this. You need to know where you stand and a staff that knows the rule.
Call us at (906) 662-4481, or contact us for a free assessment.