A new phishing attack has been identified where threat actors are creating malicious calendar links and tricking users to share them internally.  

1. External Email: A threat actor will pose as a prospective customer or someone with a business opportunity and request to be directed to another person within the institution who can assist them.  
   
2. Book a Meeting: They will then send a malicious link through a “book a meeting” button and rely on the individual they contacted to be helpful and forward it on.  
   
3. Fake Login: The booking page will have you select a date and time, then ask you to sign in to your Microsoft 365 account to complete the booking.  
   
4. Stollen Credentials: The login is fake, allowing the threat actor to steal user credentials and gain access to university systems. 
   

Most people want to be helpful and unknowingly participate in the phishing scam. A meeting link or button is more likely to be trusted when it comes from an internal source, so individuals may not think twice before clicking and entering their credentials.  

How to respond to this phish:  

• Pause and Check: If you receive an external email from someone looking for assistance, check for the usual phishing signs in their message. When in doubt, report it as phishing.  
  
• Follow Official Channels: Most departments have an official channel to receive inquiries; direct the individual to follow that process. This will typically deter a threat actor but help a sincere person.  
  
• Don’t Click: If you receive an email with a booking link and aren’t sure if it is legitimate, don’t click and offer to send the meeting invitation yourself if you really need to meet with this person.  
  
• When in Doubt, Report: You can report a phishing attempt at any time, there is no consequence for reporting a legitimate email as phishing. It will be reviewed by the IT security team, and you will receive an email notifying you if the email was legitimate or phishing and successfully blocked.   
  

Thank you for staying vigilant and keeping the university secure.