SECURITY HINTS & TIPS – Google Calendar Phishing

🚨 What Happened Recently?

Recent phishing campaigns targeted a large number of MGC Google accounts through Google Calendar invites. The calendar events with titles like “NEW Voice Message Notification” were sent from external email addresses.

The invite included a link that prompted users to “Listen to voicemail,” which redirected to a convincing fake Google sign-in page designed to steal login credentials.

🤔 How Does Calendar Phishing Work?
Just because an event shows up on your calendar doesn’t automatically mean it’s legit! Attackers exploit default settings to drop fake events onto your schedule.

Here are a few red flags to watch out for:

• Urgent or Catchy Event Titles: Look out for titles such as “Invoice,” “Payment Overdue,” “NEW Voice Message,” or “Crypto Purchase.”
• Suspicious Links & Attachments: Descriptions that ask you to click a link to listen to a voicemail, review a proposal, or log in to an account.
• Unknown External Senders: Always inspect the organizer’s actual email address—don’t rely on the display name alone!

🛡️ What IT Is Doing to Keep Us Safe
Our IT team has already removed the malicious invites and updated our organization-wide Google Calendar settings. Going forward, invitations from unknown external senders will no longer automatically pop up on your calendar. Instead, they’ll land in your email inbox so email security tools can scan them first.

💡 Quick Tips: How You Can Stay Protected

1. Verify Your Calendar Settings:
   • Open Google Calendar on your computer.
   • Click the gear icon (Settings) at the top right.
   • Go to General > Event settings.
   • Under “Add invitations to my calendar”, make sure it’s set to “Only if the sender is known” or “When I respond to the invitation in email”.
2. Report Suspicious Events:
   • In Calendar: Click the event -> click the three dots -> select Report as spam.
   • In Gmail: Use the Phish Alert Button (PAB) to report invitation emails.
3. Enable Email Verification for Appointment Schedules:
   • If you use Google Calendar Appointment Schedules, edit your schedule, go to Booking form, and check “Require email verification” to block automated bots.

🆘 What If You Accidentally Clicked a Link?
Don’t panic! Here’s what to do immediately:

1. Change your passwords right away if you were prompted to log in and entered credentials.
2. Report the incident to IT via the IT Service Desk portal or call 1-800-265-1485 ext. 82256.
3. Check your account activity for unusual sign-ins at Google Device Activity.

For further information on this and other topics, please refer to the FAQ in ITPortal.