In This Article
- What Check Point found
- Why calendar invite phishing gets the click
- The part most cleanups miss: the calendar entry
- Which Microsoft 365 plan can run the cleanup
- Four settings to check this week
- If someone typed a password into the fake page
- What to keep for your board and examiners
- How ABT and Guardian MxDR handle a phishing wave
- Frequently Asked Questions
Your loan officers, branch managers, and member service staff run their days from a calendar. A meeting invite gets a quick glance and almost never a second look. That habit is exactly what calendar invite phishing exploits. A campaign tracked by Check Point's email researchers uses fake calendar invites built to steal Microsoft account credentials, and its surge began in late September.
Calendar invite phishing is a credential-theft attack dressed as a meeting request. The message carries either a real calendar file or a link styled as a meeting invitation, and both routes end at a fake Microsoft sign-in page. For a bank, credit union, or mortgage company on Microsoft 365, the response has three parts: keep as many of the invites out as you can, clean up the ones that got through, and lock down any account whose password was typed into the fake page.
The cleanup has a step that's easy to miss. When Outlook delivers a meeting invite, it also creates an entry on the recipient's calendar, and that entry stays after the email is deleted. Microsoft's own security team describes it as a gap, and it fixed part of it last November with one specific remediation action. This article walks through that action, the Microsoft 365 plan it needs, the settings worth checking this week, and the record to keep afterward.
Key Takeaway
Removing a phishing invite from inboxes leaves behind the calendar entry Outlook created on delivery. Microsoft's Hard Delete action removes both, from Threat Explorer, advanced hunting, or the application programming interface (API), and those tools come with Defender for Office 365 Plan 2. Microsoft 365 Business Premium includes Plan 1, and so do Office 365 E3 and Microsoft 365 E3 since July 1, 2026. Decide now who in your institution can run a Hard Delete, and ask staff to report any invite they added from an attachment, because Hard Delete leaves that kind of entry in place.
What Check Point found
On October 15, 2026, Check Point published its findings on a set of large calendar invite phishing campaigns, which use fake meeting invites to harvest Microsoft account credentials. Its researchers saw a significant surge starting September 25, and activity was still running on the day of the report.
Check Point counts more than 247,270 unique sender addresses and an average of more than 8,319 emails per active day. Those figures come from mail that reached Check Point's own customers, so they describe what one vendor's filters caught. The spread of sender domains is the useful number for a defender: tens of thousands of domains means blocking senders one at a time won't keep up.
Check Point's report gives no breakdown by industry. A meeting invite fits every institution that holds meetings, which is every bank, credit union, and mortgage company in the country.
The invites arrive two ways. Some carry an .ics attachment, the standard calendar file format. Others carry a link that appears to lead somewhere it doesn't, including a fake Microsoft Teams meeting invite whose "Join" link opens a credential-harvesting page.
"The file is valid calendar data, so the attack abuses calendar features and user trust without exploiting a software vulnerability."
Why calendar invite phishing gets the click
A busy day at a financial institution is a string of meetings: loan committee, a vendor review, a closing call, a member who wants to talk about a business account. Staff accept invites the way they answer the phone, as part of the job, and an invite reads like one more item on the day's list.
That's the reason this campaign matters more than its raw volume suggests. An .ics file that is valid calendar data gives your filters no exploit to catch and gives Microsoft nothing to patch. The defense is a mix of mail filtering that judges the link and the sender, cleanup that reaches the calendar, and staff who treat an unexpected invite the way they already treat an unexpected attachment.
For the training side, the habit to build is short. An invite from someone you don't know, for a meeting you didn't expect, gets reported with the Report button before anyone clicks Join.
The part most cleanups miss: the calendar entry
When a phishing message reaches inboxes, the usual response is to pull it back out: Microsoft's zero-hour auto purge (ZAP) does it automatically, and a security team can move or delete it across mailboxes. With a meeting invite, Outlook has already put the meeting on the recipient's calendar by the time anyone looks.
"A hidden risk persists: calendar entries created by Outlook during email delivery. These entries can remain active even after the email is deleted, leaving users exposed to harmful content."
Microsoft's November 2025 post on calendar remediation gives the example directly: an admin removes a phishing meeting invite from a user's inbox, and the user can still reach the same malicious content through the calendar entry.
Your security team finds the fake invite, then moves it to Junk or deletes it from every mailbox that received it. The inboxes look clean.
The meeting Outlook created at delivery is still on each recipient's calendar, carrying the same content and the same link, waiting for someone to open it from the calendar view.
Microsoft's fix is the Hard Delete remediation action. Microsoft Learn's remediation guide describes it as purging the message "and the corresponding calendar entry for meeting invite messages." The November post says the change applies to Hard Delete taken "from any surface, including Explorer, Advanced Hunting, and API." Admins can still recover hard-deleted items using single-item recovery, so a hard-deleted message can be brought back for the investigation.
| Action | Where it runs | What Microsoft documents for the calendar entry |
|---|---|---|
| Zero-hour auto purge (ZAP) | Automatically, on Exchange Online mailboxes, for email delivered in the last 48 hours | The ZAP documentation covers the message: Junk Email or quarantine, depending on your policy |
| Move to junk, move to deleted items, soft delete | Remediation from Explorer or advanced hunting | The message moves; Microsoft ties calendar cleanup to Hard Delete |
| Hard delete | Explorer, advanced hunting, or the API | Removes the message and the calendar entry for meeting invites |
| Invite a user added from an .ics file | The user's own calendar | Stays after a Hard Delete; remove it by hand |
Microsoft calls the Hard Delete change "the first step toward closing that gap," and it is clear about where that step stops.
Two notes Microsoft attaches to the change
First, the Hard Delete cleanup "does not remove calendar entries manually added by users via .ics files." Check Point says part of this campaign arrives as .ics attachments, so anyone who opened the file and added the meeting has an entry that needs a manual delete. Second, Microsoft notes that "deleted calendar entries can be restored by resending the meeting invite." Each fresh invite from the campaign creates a new entry on delivery the same way, which is why blocking the domain behind the harvesting link belongs in the same response.
The same November update helps with the second limit. Microsoft says the Tenant Allow/Block List options for URL domains now appear inside Explorer for security operations center (SOC) staff, "enabling SOC teams to block entire domains without leaving their workflow." With more than 33,890 sender domains in play, the domain behind each harvesting link is the better thing to block. Microsoft's Tenant Allow/Block List guidance says messages that contain blocked URLs are quarantined as high confidence phishing.
Which Microsoft 365 plan can run the cleanup
Licensing decides who can run a Hard Delete from Explorer. Microsoft Learn's Defender for Office 365 overview puts Threat Explorer, automated investigation and response (AIR), and advanced hunting in Plan 2. Microsoft 365 Business Premium includes Plan 1, which has a lighter tool called Real-time detections. Microsoft's service description adds Plan 1 to Office 365 E3 and Microsoft 365 E3, effective July 1, 2026. Microsoft 365 E5 includes Plan 2.
| Capability | Business Premium or E3 (Defender for Office 365 Plan 1) | Plan 2 (Microsoft 365 E5, or Business Premium plus the Defender Suite) |
|---|---|---|
| Safe Links, Safe Attachments, impersonation protection | Included | Included |
| Zero-hour auto purge for email | Included in all Exchange Online mailboxes | Included |
| Finding who received a message | Real-time detections | Threat Explorer |
| Hard Delete from Threat Explorer or advanced hunting | Plan 2 only | Included |
| Automated investigation and response | Plan 2 only | Included |
| Attack simulation training | Plan 2 only | Included |
Microsoft sells Defender for Office 365 as an add-on to many Microsoft 365 subscriptions, so an E3 institution reaches Plan 2 through that add-on or Microsoft 365 E5. For a Business Premium institution, ABT's recommended route to Plan 2 is the Microsoft Defender Suite for Microsoft 365 Business Premium. Microsoft lists it for up to 300 users at $10.00 per user per month, paid yearly. Microsoft's Business Premium security overview lists it as including Defender for Office 365 Plan 2, Microsoft Entra ID P2, and Defender for Endpoint Plan 2.
ABT recommends the Defender Suite for every Business Premium institution, on every seat. Microsoft says Threat Explorer and Real-time detections contain data for users with Defender for Office 365 licenses assigned to them. A phishing wave goes to whoever's address the attacker has. Our guide to the E3, E5, and Business Premium decision walks through the full license comparison for financial institutions.
Four settings to check this week
Each of these lives in the Microsoft Defender portal, and together they shorten the time a fake invite sits in front of your staff.
Microsoft's ZAP documentation says the default anti-spam policy moves a late phishing verdict to Junk Email, while the Standard and Strict preset security policies quarantine it. Quarantine takes the message out of the user's mailbox.
Microsoft's Built-in protection preset applies Safe Links, Microsoft's link-scanning protection, to every recipient who isn't covered by a Standard, Strict, or custom Safe Links policy. Check that each custom policy keeps Safe Links on for email, Teams, and Office apps.
You can send user-reported messages to a reporting mailbox, to Microsoft, or both. Route them somewhere your team reads every day, because a staff report is often the first signal.
Approving remediation requires the Search and Purge role, and Microsoft supports a two-step approval where one person queues the action and another approves it. Name both people before the next wave. On Business Premium alone, this one starts with the license: running a Hard Delete from Explorer takes Plan 2, which the Defender Suite adds.
ZAP has a time window worth knowing. Microsoft says its search "is limited to the last 48 hours of delivered email," and users aren't notified when ZAP moves a message. ZAP acts on read and unread messages alike. Anything older than two days, and any link a user already clicked, is work for your team.
At an institution with a small IT team, that work lands on the same people handling password resets and new-hire laptops. Guardian MxDR, ABT's managed detection and response service, monitors email threats, including phishing campaigns, through Defender for Office 365. From Guardian Contain up, critical risk detections trigger automated containment, including session revocation, in seconds at any hour, and from Guardian Respond up, ABT security engineers investigate and remediate covered incidents during business hours.
If someone typed a password into the fake page
Assume at least one person in your institution clicked Join and signed in. Microsoft's guide to responding to a compromised email account lays out the order, and it's the order we'd follow.
Disable the account during the investigation, or reset the password if you can't, and keep the new password out of email.
Revoke the user's sign-in sessions so a stolen session token stops working along with the password.
Review the multifactor authentication (MFA) methods and devices registered to the account, and remove anything the user doesn't recognize.
Review applications the user consented to and any administrative roles the account holds.
Check mailbox forwarding and every inbox rule, including hidden ones, for anything that redirects or hides mail.
Microsoft adds one detail that's easy to miss: app passwords "aren't automatically revoked when you reset the password." Step three matters for a reason our analysis of the Knight Office phishing kit covers in depth. A device registered or a sign-in method added during the window between the phish and the containment can outlast both the password reset and the session revocation.
The longer fix is making a typed password worth less. Microsoft's compromised-account guidance highly recommends enforcing multifactor authentication on the account and calls MFA essential for accounts with admin privileges. Our guide to phishing-resistant MFA for financial institutions covers how to roll it out without stalling the help desk.
What to keep for your board and examiners
A phishing wave that reached staff is an event your board and examiners may ask about, so build the record as you go. Microsoft says the unified Action center "shows remediation actions for the past 30 days," and its action logs export up to 100,000 records. Export those logs into your incident file as soon as the cleanup is done.
- The message list: how many invites arrived, to how many users, and from which sender domains.
- The remediation export: which messages were hard-deleted, when, and by whom.
- The user reports: how many staff reported the invite, and how fast the first report came in.
- The account steps: for any user who signed in, the time of each of the five steps above.
The fourth item shows how fast your team acted once the first report came in. A dated record that shows sessions revoked within minutes of the first report is evidence. A recollection of "we handled it quickly" is a claim.
From the Guardian Respond rung up, ABT security engineers produce a written incident timeline for each covered incident, suitable for an examiner or an insurer. It belongs in the same file.
How ABT and Guardian MxDR handle a phishing wave
ABT has served over 750 financial institutions in 25 years. We're a Tier-1 Microsoft Cloud Solution Provider primarily dedicated to financial services, and we manage our clients' Microsoft 365 tenants under the delegated access they grant. A calendar invite campaign touches both halves of that work: the Defender for Office 365 configuration that decides what gets through, and the response when something does.
The calendar entry problem is a good example of why a configured tool and a working response are two different things. Defender for Office 365 does its job on the message. Someone still has to know that a meeting invite leaves a second copy on the calendar, have the license that reaches it, and hold the role that approves it.
Every Microsoft 365 Guardian rung includes Microsoft Defender for Office 365 configuration, so your Defender for Office 365 policies sit on a hardened baseline before a wave arrives. Guardian MxDR watches both halves of this attack: phishing campaigns through Defender for Office 365, and identity signals from Microsoft Entra ID.
A phishing compromise is a security incident, and Guardian is built for it. Guardian MxDR is the managed detection and response component of the Guardian operating model, and the rung you choose sets how far ABT goes. Guardian Contain adds round-the-clock detection across identity, endpoint, email, and cloud apps on Microsoft Defender XDR signals, correlated by ABT's own detection engine, with pre-authorized automated containment: when a critical risk detection fires, session revocation runs in seconds at any hour, with no human in the loop. When that trigger fires, step two of the response above is already underway.
Guardian Respond puts ABT security engineers on covered incidents during business hours to investigate and remediate. From Respond up, each covered incident gets a written timeline suitable for an examiner or an insurer. Guardian Resolve has a human on the incident at any hour.
The place to start is ABT's free Microsoft 365 security assessment. It reviews your anti-phishing policies, Defender for Office 365 settings, and Safe Links and Safe Attachments status through a read-only connection, and it scores each area against ABT's benchmark from more than 750 financial institution tenants.
Get ahead of the next phishing wave with Guardian MxDR
Start with a free security assessment of your Defender for Office 365 setup. Then talk with ABT about Guardian MxDR: email threats monitored through Defender for Office 365, automated containment around the clock from Guardian Contain up, and ABT security engineers on covered incidents, in business hours at Guardian Respond and at any hour at Guardian Resolve.
Frequently Asked Questions
Calendar invite phishing is credential theft disguised as a meeting request. The message carries a real .ics calendar file or a link styled as a meeting invitation, such as a fake Microsoft Teams Join link, and both lead to a fake sign-in page. Check Point reported a surge of these campaigns starting September 25, 2026.
Deleting the email leaves the calendar entry Outlook created on delivery, according to Microsoft's Defender for Office 365 team. Microsoft's Hard Delete remediation action removes both the message and the calendar entry for meeting invites. Entries a user added manually from an .ics file stay and need deleting by hand.
Run a Hard Delete on the phishing invite from Threat Explorer, advanced hunting, or the API. Since November 2025, Microsoft says Hard Delete also removes the associated calendar entry for meeting invites, though entries users added manually from an .ics file stay and need deleting by hand. Approval needs the Search and Purge role.
Business Premium includes Defender for Office 365 Plan 1, which has Real-time detections. Threat Explorer, advanced hunting, and automated investigation are Plan 2. Business Premium institutions can add Plan 2 through the Microsoft Defender Suite for Business Premium, which Microsoft sells for up to 300 users at $10 per user per month, paid yearly.
Zero-hour auto purge (ZAP) acts on a phishing message when the verdict arrives after delivery, within 48 hours: Junk Email under the default anti-spam policy, quarantine under the Standard and Strict preset policies. Microsoft documents calendar entry removal for the Hard Delete action, so plan a Hard Delete whenever a phishing invite reached users.
Follow Microsoft's compromised-account steps in order: disable the account or reset the password, revoke sign-in sessions, review registered MFA methods and devices, review consented apps and admin roles, then check forwarding and inbox rules, including hidden ones. App passwords survive a reset, so remove them. With Guardian Contain, critical risk detections trigger session revocation in seconds at any hour.
Check Point's October 15 report gives no industry breakdown. It counts more than 40,000 targeted organizations and more than 33,890 sender domains. Banks, credit unions, and mortgage companies run on meetings like every other business, so a fake invite fits their day, and the Microsoft 365 controls in this article apply to them directly.
