That Meeting on Your Calendar Might Not Be a Meeting

For years, cybersecurity training has taught employees how to spot a phishing email. Check the sender, look for spelling mistakes, hover over links, be suspicious of unexpected attachments, and don’t click on anything that doesn’t look right. That’s still good advice, but what if the phishing attempt doesn’t look like an email at all?

Attackers are increasingly finding ways to reach employees through the tools they use every day, including calendar invitations, text messages, QR codes, collaboration platforms, phone calls and even legitimate authentication processes. The tactics are changing and our security habits need to change with them.

Phishing Has Moved Beyond the Inbox

Imagine opening your calendar on Monday morning and seeing a meeting you don’t recognize. Maybe it looks like a Microsoft support appointment, a billing issue, an account-security alert, or a meeting invitation from someone whose name looks familiar. There’s a link in the event telling you where to go next. Would you give it the same scrutiny you would an unexpected email? That’s exactly the assumption attackers are beginning to exploit.

Security researchers have documented phishing campaigns using calendar invitations to put malicious content in front of potential victims. Because calendar events appear in a familiar, trusted part of someone’s workday, they can feel more legitimate than an obvious spam email. Calendar invitations are only one example. Attackers may use:

The delivery method may change, but the goal is often the same: convince someone to trust the request and take an action that gives the attacker access.

Why These Attacks Can Be So Effective

Employees have become more cautious about email, and organizations have gotten better at filtering suspicious messages before they ever reach an inbox. However, attackers adapt. Instead of relying solely on a suspicious-looking email, they can move the interaction somewhere people aren’t conditioned to be as skeptical.

A calendar event feels routine, a Teams message feels internal, a QR code doesn’t show you where it’s taking you before you scan it, and an MFA notification may look exactly like the ones you’ve approved dozens of times before.

There is another advantage for attackers: urgency. Your account will be locked. A payment needs approval, IT needs to fix something immediately, your password is expiring, your boss needs something before a meeting. The more urgent the request feels, the less likely someone may be to stop and question it. That’s why recognizing phishing can’t depend on memorizing a list of places where attacks might appear. There will always be another place. Instead, employees need a habit they can use regardless of how the request reaches them.

Stop. Verify. Act.

One of the simplest ways to approach an unexpected request is to follow three steps:

Stop

Before clicking a link, scanning a QR code, approving an authentication request or providing information, take a moment. Was the request expected? Does it make sense? Is someone creating unnecessary urgency? If something feels unusual, don’t let the apparent source of the message convince you that it’s safe.

Verify

Confirm the request using a method you already trust. An unusual Teams message asking for sensitive information warrants a quick check. Call the coworker using a number you already have rather than relying on the message itself. For unexpected account alerts, skip the provided link and go directly to the service through the website or application you normally use. An MFA request you didn’t initiate should never be approved. And before responding to a calendar invitation that asks you to sign in, download something or provide information, verify the meeting and sender first. The key is to verify independently of the request itself.

Act

Once you’ve confirmed the request is legitimate, proceed. If it isn’t, or you’re still unsure, report it through your organization’s established process. Employees shouldn’t feel pressured to make the determination alone. They should know who to contact when something doesn’t look right.

Technology Helps. People Still Matter.

Email filters, endpoint protection, multifactor authentication and other security tools are essential parts of a cybersecurity program, but no technology can eliminate every attempt to manipulate a person. Attackers know employees are often the bridge between a protected system and the access they’re trying to obtain. That’s why security awareness can’t simply teach people to “watch out for phishing emails.”

Employees need to understand how social engineering works, what unusual requests look like across different channels and how to verify something before acting. Organizations should also make reporting easy. If employees aren’t sure where to send a suspicious calendar invitation, text, Teams message or MFA request, valuable time can be lost.

Change the Question

Instead of teaching employees to ask: “Does this email look suspicious?” Teach them to ask: “Was I expecting this, and can I verify it?” That question works whether the request arrives by email, calendar invitation, text message, QR code, collaboration platform or authentication prompt.

The goal isn’t to make employees distrust every notification that appears on their screen. It’s to create a simple habit around unexpected requests: Stop. Verify. Act.

At 360 Security Services, we help organizations prepare for the threats employees are encountering today, not just the ones they’ve been trained to recognize in the past. From security awareness and testing to broader cybersecurity planning, we can help strengthen your organization’s defenses as attack methods continue to evolve. Is your team prepared to recognize phishing when it doesn’t look like phishing? Let’s talk.