The phishing email is gone. Why is the meeting still there?

The question

What we told them

It's a problem, and it's a gap a lot of email security tools leave open. A meeting invite arrives as an email with a calendar file attached. In both Microsoft 365 and Google Workspace, the calendar can add that event the moment the message lands, often before anyone opens or accepts it. When your filter later quarantines the email, it removes the message. Many filters don't touch the calendar entry the message already created.

So the phishing link you were protected from in your inbox is now sitting on your calendar, with a reminder that will pop up and nudge you to click it at exactly the right time. Researchers at Sublime Security documented this in both platforms, and Check Point tracked a single Microsoft 365 campaign this month that sent more than 300,000 of these invites to over 40,000 organizations. Calendar phishing works because people trust their calendar more than their inbox.

What to do now: delete that event, don't open its link, and tell anyone else who got the same invite to do the same. If you clicked it and typed a password, change that password and check your account for new sign-in methods.

What to fix next: ask whoever runs your email security one question: when you quarantine an email, do you also remove the calendar event it created? If the answer is no or "we're not sure," your admin can search mailboxes for the event and delete it, and should add that step to how quarantined invites are handled. In Google Calendar, you can set "Add invitations to my calendar" to only add invites from known senders, which stops strangers from putting events on it in the first place.