Meeting invitations are part of our everyday work. We receive them through Outlook and Teams and often treat them as routine business communication.
But what if an invitation that looks like a genuine meeting is designed to steal your work account details?
Recently, a phishing campaign targeting thousands of organisations used fake meeting invitations to trick users into revealing their Microsoft account credentials. The invitations contained calendar attachments or deceptive meeting links that could lead to fraudulent sign-in pages.
How Does It Work?
You may receive an unexpected meeting invitation that appears to be from Microsoft Teams or another familiar service. It may contain a “Join Meeting” link or instructions to review meeting details.
Clicking the link could take you to a fraudulent sign-in page designed to capture your Microsoft credentials. In some cases, the invitation may enter your calendar and appear alongside genuine meetings.
What Should You Look Out For?
- Meetings you weren’t expecting: Invitations with no clear connection to your work or scheduled activities.
- Unfamiliar organisers: Names or email addresses you cannot confidently verify.
- Misleading meeting links: A “Join Meeting” button that leads to an unfamiliar website rather than the expected meeting service.
- Unexpected sign-in requests: A meeting link that asks you to enter your Microsoft credentials again on an unfamiliar page.
- Suspicious calendar attachments: Unexpected calendar files or invitations containing unusual instructions or links.
Remember, a meeting invitation appearing in your calendar does not automatically mean it is genuine.
How Can You Protect Yourself?
- Verify unexpected invitations with the supposed organiser through a separate, trusted communication channel.
- On a computer, hover over a meeting link to inspect its destination before clicking.
- Access Teams or Microsoft 365 through your usual trusted route if you need to confirm a meeting.
- Never enter your work credentials on an unfamiliar page reached through an unexpected invitation.
- Report suspicious invitations to IT, even if they appear directly in your calendar.
- If you have entered your credentials on a suspicious page, contact IT immediately.
Remember
Attackers take advantage of familiar workplace activities because we are less likely to question them.
Before you join a meeting or sign in through an invitation, pause and verify that it is genuine.
🔐 CyberDesk – Protecting Our Digital Workplace
