Google Calendar Invite Phishing Protection for Google Workspace
Learn how to stop calendar invite phishing in Google Workspace, including remediation that removes the email and the malicious calendar event.
.png){kind=logo}
Calendar invite phishing exploits a Google Workspace default: invites land directly on a recipient's calendar with no click and no acceptance required. Protecting against it means more than quarantining the email. It requires detecting compromised sending accounts, removing the calendar artifact itself, and sweeping calendars for invites that already got through.
Sources: AegisAI, State of the AI Attack, Q3 2026; Lawrence Berkeley National Laboratory.
What is calendar invite phishing in Google Workspace?
Calendar invite phishing uses the meeting invitation feature inside Google Workspace as the delivery mechanism instead of a traditional email link or attachment. Because Google adds many invites to a recipient's calendar automatically, the lure can appear as a legitimate-looking meeting entry before the target ever opens an email.
According to cyber alert guidance published by Lawrence Berkeley National Laboratory, attackers are exploiting this default setting to place fake events, such as password expiration warnings or invoice confirmations, directly onto user calendars, where they sit alongside real meetings and look routine.
Why does quarantine alone fail to stop calendar invite worms?
Most secure email gateways act on the email that delivered the invite. They can quarantine the message or block the sender domain. But the calendar event created by that invite is a separate object inside Google Workspace. If the event was already added before the email is flagged, quarantining the email does not remove the event from the victim's calendar.
This gap matters more with self-replicating campaigns. AegisAI threat intelligence tracked a campaign designated AEGIS-IS-REDTIDE-002, described in the RED TIDE calendar-invite worm analysis, that used compromised Google Workspace mailboxes to send invites that were self-replicating, mailbox to mailbox. Per the report, the campaign reached 73% of tracked organizations, and in the fastest confirmed replication, under 19 minutes passed between an invite reaching a corporate mailbox and a different mailbox at the same company sending the next wave.
A worm that moves that fast cannot be contained by email quarantine alone, because by the time the email is reviewed, the calendar event is already present and the compromised account may already be sending the next wave.
How did RED TIDE spread mailbox to mailbox in under 19 minutes?
The mechanics described in the report follow a consistent pattern:
- 1. CompromiseAn attacker compromises a Google Workspace mailbox, often through credential theft elsewhere.
- 2. SendThe compromised mailbox sends calendar invites to internal contacts, inheriting the trusted-sender reputation of a real colleague.
- 3. LandGoogle adds the invite to each recipient's calendar automatically, with no click and no acceptance required.
- 4. RepeatA recipient's own account is compromised through the invite, and the cycle repeats from a new internal sender.
Because the sender is a real, internal Google Workspace identity, standard spoofing defenses such as DMARC do not apply. The email is not forged. It is coming from a legitimate account that has already been taken over, a pattern also discussed in AegisAI's broader analysis of account takeover protection requirements for cloud mailboxes.
What does full remediation of malicious calendar invites require?
The report's guidance on remediation is direct: when a phishing email is quarantined, remove the calendar event it created too, and sweep calendars for malicious invites that already got through. This means remediation has to operate on two linked artifacts, not one.
| Remediation step | Quarantine-only approach | Full remediation approach |
|---|---|---|
| Phishing email in inbox | Removed or flagged | Removed or flagged |
| Calendar event already created | Left in place | Removed from recipient's calendar |
| Historical sweep for prior invites | Not performed | Performed across mailboxes |
| Compromised sender account | Not addressed | Flagged for behavior review |
| Downstream recipients already invited | Not checked | Checked and cleaned |
Skipping the calendar sweep leaves live malicious events on calendars even after the triggering email is gone, which keeps the lure (and any phishing link embedded in the event description or location field) accessible to the user.
How can you detect a compromised Google Workspace account before it spreads?
Because RED TIDE-style campaigns rely on real, compromised accounts rather than spoofed domains, detection has to shift from sender-identity checks to behavior monitoring. Relevant signals include:
- Sudden bursts of outbound calendar invites to internal contacts from an account that doesn't normally send many meeting requests
- Invites sent at unusual hours relative to the account's normal pattern
- New OAuth grants or mailbox rule changes on the sending account around the same time
- Invite content that matches known phishing lures (password expiration, security alerts, invoice confirmations), consistent with patterns noted in the Lawrence Berkeley National Laboratory cyber alert
This kind of pre-delivery and behavioral analysis is covered in AegisAI's work on inbound email security and in the detailed walkthrough of calendar phishing remediation, which addresses how to act once a compromised account is identified.
How does API-based protection work without MX changes?
A common buyer concern is whether stopping calendar invite phishing requires rerouting mail flow through a gateway, with MX record changes and added latency. API-based integration with Google Workspace avoids this. Instead of sitting in the mail path, the protection connects directly to the Workspace environment to:
- Investigate messages and calendar events before and after delivery
- Monitor account behavior for signs of compromise, such as abnormal invite volume or new forwarding rules
- Remove both the phishing email and any calendar event it generated, in one remediation action
- Sweep historical calendar data for invites that match newly identified malicious patterns, even if they arrived before detection
AegisAI's approach to this model is outlined in how to evaluate API-based email security, which covers the tradeoffs between gateway and API deployment for cloud email platforms like Google Workspace.
Key takeaways
- Google Workspace adds many calendar invites automatically, with no click required, which makes calendar invites a direct phishing delivery path.
- AEGIS-IS-REDTIDE-002 reached 73% of tracked organizations using compromised Workspace mailboxes to self-replicate, per AegisAI threat intelligence.
- The fastest confirmed replication was under 19 minutes between an invite landing and a new mailbox at the same company sending the next wave.
- Quarantining the delivery email does not remove a calendar event already created on a recipient's calendar.
- Full remediation requires removing both the email and the calendar artifact, plus a sweep for invites that already got through.
- API-based integration can monitor account behavior and remediate both artifacts without MX changes.
FAQ
Does quarantining a phishing email also delete the calendar event it created?
Not automatically. The calendar event is a separate object in Google Workspace. If it was added before the email was flagged, it remains on the recipient's calendar until it is specifically removed.
Why doesn't DMARC stop calendar invite worms like RED TIDE?
Per the report, RED TIDE used compromised Google Workspace mailboxes rather than spoofed domains. DMARC validates sender authenticity for domains, but it cannot detect a legitimate, authenticated account that has already been taken over.
Can Google Workspace settings alone prevent calendar invite phishing?
Changing calendar settings to require manual acceptance of invites from unknown senders reduces automatic exposure, but according to the Lawrence Berkeley National Laboratory alert, this can also delay legitimate invites from external partners and requires users to manually confirm more meetings.
What should security teams check first after a calendar invite phishing report?
Confirm whether the sending account shows signs of compromise, such as unusual invite volume or new mailbox rules, then sweep for related calendar events across other recipients before closing the incident.
Remove the email and the invite
If your organization uses Google Workspace, review whether your current email security can remove both the phishing email and the calendar event it creates, and whether it can detect a compromised internal account before it sends the next wave. Book a demo with AegisAI to see how pre-delivery investigation and calendar remediation work together on Google Workspace without MX changes. If you want to read more about these topics, check out AegisAI's State of the AI Attack report.
Related posts
More from the AegisAI blog.