chat
expand_more

Attackers Disguise Malware as Calendar Invite Attachment

Meeting invites are one of the most common types of emails sent today, so it should come as no surprise that attackers have found a way to manipulate them. Scores of recipients that utilize Abnormal Security recently received emails that contained a .ics attachment—an invitation file commonly used to populate online calendar applications with meeting and event information.
December 9, 2021

Meeting invites are one of the most common types of emails sent today, so it should come as no surprise that attackers have found a way to manipulate them. Multiple organizations that utilize Abnormal Security recently received emails which contained a .ics attachment—an invitation file commonly used to populate online calendar applications with meeting and event information.

The potential danger arises when a user clicks on the supposed ICS file, unknowingly commencing the process to download malware exploiting the Dynamic Data Exchange (DDE) vulnerability present in Microsoft applications.

About the Calendar Invite Attack

First discovered in summer 2021, calendar invite attacks (CIAs) have been increasingly targeting Abnormal customers across a wide range of industries. Unlike credential phishing attacks, which request a recipient’s login credentials for a popular email service provider or other service, calendar invite attacks are disguised as ICS files, which are commonly used to reserve time on the recipient’s calendar application for an event such as a Zoom or Microsoft Teams meeting.

Unfortunately, the popularity of hosting events or holding meetings virtually makes it easier than ever for bad actors to persuade recipients into clicking a malicious attachment masquerading as a calendar invite file. In this example, the email simply states “download to read” and includes an ICS file attachment.

Calendar invite email with a disguised ICS file

Because the attachment is a known file type, these attacks bypass traditional email security tools and may trick recipients into opening them, believing the file type to be safe.

Calendar invite email ICS attachment

Using Social Engineering for ICS Attacks

Before analyzing the contents of the malware, let’s take a look at the social engineering techniques involved in this attack. In this campaign, attacks with the same subject line were sent to various types of organizations, including media companies.

It would not be unforgiving to speculate that, given the subject line and the sender domain, the recipient was perhaps expecting information regarding a judgment for an employee against a school district in California, as noted in this article. By targeting those who would be most interested in the information, the attacker encourages recipients to click—ultimately downloading the malware that has bypassed security filters with its ICS file type.

Making it even harder to detect, the attack passed authentication from the sender domain. Further analysis by Abnormal shows that the messages were sent from numerous different country domains, including India, Italy, and South Korea, all containing vague and succinct language that was followed by a .ics attachment ready to be downloaded.

The Virus That Evades Antivirus

What makes this attack quite dangerous when compared to others is how much more covert it is. The bad actor simply has to find a way to force the recipient into commencing the Dynamic Data Exchange (DDE) protocol, a protocol in which a plethora of Microsoft applications use to communicate with one another, and provide a prompt to ask the user whether they would like the application to run. The most active portion of the code has been highlighted below.

Calendar invite malware code

Upon completion, the malware has been installed after which the threat actor can perform a variety of nefarious acts.

Detecting and Removing the Calendar Invite Attack

Fortunately for the customer described in this scenario, the attack was stopped within nine seconds of reaching the user’s mailbox. It was remediated once again when a carbon copy of the attack was received by the same user five days later.

How Abnormal Prevents Malware Attacks

And it appears that this attack type may not be going away in the near future, as cybercriminals have found a new way to bypass secure email gateways. After all, ICS files are used in millions of legitimate emails each day, and recipients are likely to click on something they see as familiar.

In the dozens of calendar invite attacks that have been found since, Abnormal’s machine learning algorithm and security analysts worked in tandem to label each calendar invite attack as malicious, remediating it from the recipients' inboxes before the malware could be accessed.

To learn how Abnormal detects ICS file attacks, without blocking all calendar invitations sent to your organization, request a demo today.

Attackers Disguise Malware as Calendar Invite Attachment

See Abnormal in Action

Get a Demo

Get the Latest Email Security Insights

Subscribe to our newsletter to receive updates on the latest attacks and new trends in the email threat landscape.

Discover How It All Works

See How Abnormal AI Protects Humans

Related Posts

B Vendor Email Compromise Case Study Blog
See how a real vendor email compromise attack fooled multiple employees. Learn why VEC succeeds and how AI makes these threats more dangerous.
Read More
AI Innovation Using AI to Simplify Cover pptx
Explore how Abnormal's engineering team advances internal development with an AI-driven platform that standardizes infrastructure, reduces setup time, and enables both engineers and AI agents to build and deploy services more efficiently.
Read More
B Flux Panel Ecommerce Checkout Hijacking via Phishing
FluxPanel turns legitimate ecommerce checkouts into live data theft operations. Learn how this dark web tool works, the role phishing plays, and how to stop attacks at their source.
Read More
B Fin Serv Attack Trends Blog
Email attacks on financial services rose 25% year-over-year. Learn why FinServ is a top target and how threat actors exploit trust to deceive employees.
Read More
B Flask Phishing Kit
Learn how threat actors used Flask, a popular Python framework, to build a versatile phishing kit for evasive campaigns that bypass traditional defenses.
Read More
B-Trust Trap Social Engineering Blog
The psychology of the modern work environment has become a roadmap for attackers—and a blind spot for traditional email security.
Read More