2026-10-20
SECURITY HINTS & TIPS:
GOOGLE CALENDAR PHISHING
October is Cybersecurity Awareness Month and the theme is: “Don’t Make It Easy for Them.”
📊 Quick Reference: 2026 Threat Breakdown
| Threat Vector | What It Looks Like | Your Best Move |
|---|---|---|
| AdFection 🚨NEW | Zero-click exploits (malvertising/malicious ads on legitimate sites that silently load exploits without requiring a click). | Keep browsers and software fully updated and avoid visiting untrusted or unverified websites. |
| Calendar Phishing | Fraudulent meeting invites added directly to a calendar containing phishing links. | Verify or delete unexpected calendar events immediately. |
| Smishing (SMS Scams) | Text messages delivering phishing links or impersonating IT support. | Never click links in unexpected texts; verify via official channels. |
| ClickFix / Fake CAPTCHA | Pop-up asking you to copy/paste a command to verify your browser. | Close the tab immediately! Never run commands from web pages. |
| Quishing (QR Phishing) | QR code on an email invoice or poster leading to a login screen. | Don’t scan unexpected codes; visit official sites directly. |
| Fake IT Support | Teams message or call asking to install remote assistance software. | Verify their identity via an official phone or internal directory. |
| AI Voice / Phone Scams | Urgent call asking for financial transfers. | Call back using a known, trusted phone number. |
| App Permission Scams | Third-party app requesting access to your email or drive files. | Deny unverified apps. |
| AiTM (Adversary-in-the-Middle) | Proxy login site intercepting MFA codes and session tokens. | Check the browser address bar before logging in; use MFA when possible. |
| OAuth Device-Code Scams | Prompts directing you to a legitimate page with a device code to enter. | Never enter device codes you didn’t personally request. |
🛡️ 5 Daily Habits to Stay Shielded
- Pause at Urgency Anywhere: Malicious links can originate anywhere—including emails, calendar notifications, messaging apps, and SMS. Pressure plays require extra verification.
- Never Run Web Commands: A legitimate website or CAPTCHA will never instruct you to open a command prompt or paste code to verify yourself.
- Inspect Link Destinations: Check full web address before entering credentials. Don’t trust pages solely based on logos or icons across apps.
- Treat Invites & QR Codes Like Links: Verify unexpected calendar invites, texts, or QR codes before interacting with embedded links.
- Report Anything Weird Fast: While the Phish Alert Button (PAB) handles emails, report non-email threats (like calendar invites or texts) directly via a Service Desk ticket.
💡 Remember: Your Best Defence is You
Cybersecurity isn’t a once-a-year training module—it’s an everyday defence layer. By slowing down, checking links, and making safer choices, you strip away targets cybercriminals rely on.
Have questions or need to report suspicious activity? Review our IT Portal FAQ, reference the ISMS, discuss with your manager & submit Service Desk tickets!
Manitoulin Group of Companies Security Team
Cybersecurity@manitoulingroup.
Stop, Look, and Think. Don’t be fooled.