A calendar phishing scam, previously observed targeting Android and Google users between 2019 and 2021, is now reportedly targeting iPhone owners in 2026. This re-emerging threat exploits the automatic addition of calendar invites to a user's schedule, using these events for phishing or misinformation campaigns.
Millions of iPhone owners are reported to be targets of this re-emerging scam.
This exploitation of automated calendar features poses a significant risk to user security and can be a vector for various malicious activities.
Mitigation Strategies
To address the threat of calendar scams and protect personal information, the following measures are recommended:
Decline Invitations
Users can decline unwanted calendar event invitations. For multiple invitations from a known malicious source, there is often an option to decline a series or sequence of events, which can save time and streamline the clean-up process.
Review Calendar Settings
It is crucial to check subscribed calendars within iPhone settings (Settings > Apps > Calendar). This allows users to identify and remove any unintended or suspicious subscriptions that may be pushing unwanted events to their schedule.
Disable Automatic Calendar Events
Adjusting settings within your calendar applications can prevent the automatic addition of invitations, putting users back in control.
- Google Calendar: In Calendar's Settings, navigate to "Add invitations to my calendar," and select either "only if the sender is known" or "when I respond the invitation." This ensures invites are not automatically added from unknown sources.
- Microsoft Outlook Calendar: Users should consult Outlook's specific settings for managing calendar invites, as options may vary.
- Apple Calendar: Consider disabling Siri Suggestions for the calendar app. This feature, while convenient, can sometimes inadvertently add events from unsolicited invitations.
Block Senders
If the email address of a scammer is known, blocking the sender can prevent future unsolicited invitations. However, it is important to note that scammers frequently use various email addresses, which may require repeated blocking actions to maintain protection.