Keep seeing strange meetings and events in your calendar? It might be because calendar-based phishing has jumped 33,000% since May — and they work even if the email is sent to spam

ICS phishing has finally "hit the mainstream"

by · TechRadar

News By Sead Fadilpašić Published 18 September 2026

(Image credit: Shutterstock)

Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter

  • Sublime researchers warn ICS phishing via calendar invites is surging ~33,000% since May 2026
  • Attacks bypass filters, trick users into installing RMM tools like ScreenConnect for full compromise
  • Defenses: scrutinize suspicious invites, verify senders, and treat ICS attachments with caution

ICS phishing - the type of phishing that abuses calendar files (.ics) is set to increase by around 33,000% between May and September 2026. This is according to a new report by cybersecurity researchers Sublime, who argue that this type of phishing has finally “hit the mainstream”.

The methodology is simple - the attacker uses a free service, such as Gmail, and sends a calendar invite to the target. Since both services are legitimate and free, the attacks bypass most email security filters and can be done at scale with close to zero cost.

Furthermore, the victim is exposed to the attack twice: once in the inbox, and once in their calendar. Inside the calendar invite is usually a link to download a maliciously configured remote management and monitoring (RMM) solution such as ScreenConnect. The attackers can use the tool to take over the compromised endpoint, deploying stage-two malware such as infostealers or ransomware, and grabbing passwords, documents, and other valuable secrets.

Latest Videos FromTechRadarWatch full video here:

Spiking in popularity

ICS phishing started increasing in popularity roughly a year ago, but has been really picking up speed lately. Between May and June it increased 282%, and between June and July - 338%.

Between July and August it rose 1,216%, and in just the first half of September it rose 1,426% over the full month of August. Projections for the entire month of September, over August, are 2,852%, Sublime says.

“The jumps in August and September appear to be indicators that this attack type has finally hit the mainstream,” the researchers explained. “To really drive that point home, the increase from May to September is projected to be ~33,000%.”

Defending against these attacks is best done with a little common sense, the researchers conclude. Users should be mindful of the telltale signs, such as suspicious CTAs, suspicious senders, and the usual financial urgency.

Are you a pro? Subscribe to our newsletter

Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!

Contact me with news and offers from other Future brandsReceive email from us on behalf of our trusted partners or sponsors