Barracuda warns calendar invites are being used for phishing via .ics files

Barracuda researchers are warning organisations to treat calendar invitations as a phishing risk, as attackers increasingly abuse iCalendar (.ics) files to bypass controls that focus primarily on email bodies and traditional attachments.

In an analysis by Associate Threat Analyst Soundharya Bharani Poomalai, Barracuda said malicious calendar events can carry phishing links, QR codes and business-themed lures designed to direct recipients to credential-harvesting pages, including through adversary-in-the-middle (AiTM) phishing platforms.

The company said the approach works in part because calendars are now used for more than meetings, including reminders for training, compliance activities and corporate announcements, making non-meeting invitations appear routine. Barracuda also noted that calendar entries may be added automatically with little user interaction, can persist even if the original email is deleted or quarantined, and are commonly handled on mobile devices where some desktop-focused controls have limited visibility.