How to Stop ICS Phishing Attacks in 2025

What You'll Learn

In this guide, we are looking at the mechanics of ICS phishing, a rapidly growing threat vector that bypasses traditional email security by injecting malicious payloads directly into your calendar. By the end of this tutorial, you will understand how to reconfigure your email and calendar clients to disable the dangerous auto-add features that hackers are currently exploiting. We will cover specific settings for Gmail, Microsoft Outlook, and Apple Mail, ensuring you can identify these threats before they hit your device.

You will also learn how to build an automated filter system using script-based logic to intercept suspicious invitations before they populate your schedule. We are moving beyond basic advice; this is about hardening your digital infrastructure against the 2,852% growth in calendar-based attacks projected for the coming months.

Prerequisites & What You Need

To follow this guide effectively, you need administrative access to your primary email accounts. You do not need deep coding knowledge, but a basic understanding of how API-based rules work is helpful.

• Email Provider Access: Google Workspace, Microsoft 365, or Apple iCloud account.
• Device Access: A desktop environment for granular configuration.
• Security Mindset: A willingness to break the convenience-first workflow that makes these attacks possible.
• Optional: A basic grasp of Google Apps Script if you want to automate the deletion process.
• System Requirements: No specific hardware, but ensure your browser is updated to the latest stable release to handle modern security headers.

Step-by-Step Guide

The core of the problem lies in the iCalendar (ICS) standard, which assumes that all meeting invitations are legitimate. We need to flip that assumption on its head.

Step 1: Disable Auto-Add in Google Calendar

Google Calendar's default setting is to add every invite to your schedule, even if you haven't RSVP'd. This is the primary entry point for modern malware.

1. Open Google Calendar (calendar.google.com)
2. Click the Gear icon in the top right and select 'Settings'
3. Navigate to 'Event settings' in the left sidebar
4. Find 'Add invitations to my calendar'
5. Change the dropdown from 'From everyone' to 'When I respond to the invitation in email'

By changing this setting, you prevent unvetted invitations from ever appearing on your primary schedule. The event will remain in your inbox, where your existing spam filters have a much better chance of catching it.

Step 2: Hardening Microsoft Outlook

Outlook is a frequent target because of its deep integration with corporate environments. You need to disable the 'Auto-Accept' or 'Auto-Add' features in the web and desktop versions.

// Pseudocode representation of the logic to disable in Outlook settings
function disableCalendarAutoAdd() {
  const outlookSettings = User.getSettings('Calendar');
  outlookSettings.set('AutoAcceptMeetingRequests', false);
  outlookSettings.set('AutomaticallyAddEventsToCalendar', false);
  outlookSettings.save();
}

If you are in an enterprise environment, contact your IT admin to push a global policy change that disables the automatic processing of ICS attachments via the Exchange Admin Center.

Step 3: Implementing a Script-Based Filter

If you are using Google Workspace, you can utilize a simple Apps Script to purge calendar invites containing suspicious links from known high-risk domains.

function purgeSuspiciousInvites() {
  var calendar = CalendarApp.getDefaultCalendar();
  var events = calendar.getEvents(new Date(), new Date(new Date().getTime() + 86400000));
  events.forEach(function(event) {
    if (event.getDescription().includes('bit.ly') || event.getDescription().includes('framer.com')) {
      event.deleteEvent();
    }
  });
}

Real-World Example

Imagine you receive an email claiming to be a financial invoice credit. The email is cleverly disguised, but the true threat is the attached .ics file. Because your calendar auto-adds this, your phone pings with a notification: 'Invoice Credit Discussion - 2:00 PM.' You open the invite, see a 'View Here' button that looks legitimate, and click it. That click triggers a download of an MSI installer. This installer uses a legitimate tool like ScreenConnect to open a C2 tunnel to the attacker's server. By following the steps above, that invite would have stayed in your inbox, allowing your email security software to flag the malicious link before you ever saw the notification.

Pro Tip: If you receive a calendar invite from an unknown sender, never click 'Decline.' Declining sends a signal back to the attacker that your email address is active and monitored, which usually leads to a spike in future phishing attempts.

Common Mistakes & Troubleshooting

• Mistake 1: Clicking 'Decline' on malicious invites. Fix: Just delete the email. Do not interact with the invite UI.
• Mistake 2: Assuming mobile apps share settings. Fix: Changing the setting on your desktop web interface does not always sync to the mobile app. Check the app settings on your phone as well.
• Mistake 3: Ignoring the 'Report Spam' button. Fix: Always report the invite as spam. This helps the provider train its ML models to block similar attacks for other users.
• Mistake 4: Using free hosting services for work. Fix: If you see a link pointing to 'framer.com' or other free hosting services in a meeting invite, treat it with extreme prejudice.
• Mistake 5: Allowing auto-processing of attachments. Fix: Use a sandbox environment if you must inspect an attachment. Never open an ICS file locally.

Pro Tips & Advanced Usage

To stay ahead of these threats, consider these advanced strategies:

• Use a dedicated calendar for non-essential invites: Create a secondary calendar that is not synced to your primary devices.
• Implement DMARC/SPF/DKIM: If you run your own domain, ensure these records are strictly enforced to prevent spoofed meeting invites.
• Educate your team: Host a brief session on why 'Calendar Phishing' is a thing. Many developers assume phishing is only email-based.
• Leverage EDR: If you are on a corporate machine, ensure your Endpoint Detection and Response tool is configured to alert on unauthorized MSI file executions.
• Use 'Look-alike' domain monitoring: Use tools that monitor for registrations of domains that mimic your company's domain.
• Restrict calendar sharing permissions: Set your calendar to 'Private' by default.
• Disable public search: Ensure your calendar is not indexed by search engines.
• Review API permissions: Regularly audit which third-party apps have 'Calendar' permissions in your Google/Microsoft account.
• Enable 2FA everywhere: It won't stop the calendar invite, but it stops the secondary fallout if you accidentally provide credentials.
• Monitor for unusual activity: Set up alerts for logins from new devices or unexpected geographical locations.
• Audit your browser extensions: Malicious extensions can sometimes read your calendar data and inject invites.

Security Note: The surge in these attacks, specifically the 2,852% increase projection, is driven by the fact that calendar invites are seen as 'high-trust' objects. Attackers know you check your calendar to organize your day, not to vet for malware.

What's Next: Related Tutorials & Next Steps

Now that you have hardened your calendar, you should address the broader email security landscape. I recommend looking into tutorials on how to set up advanced email filtering rules and how to use AI-powered phishing detection tools. For those managing enterprise environments, looking into how to automate the blocking of suspicious domains via your firewall or proxy service is the next logical step.

If you are interested in how AI is changing the security game, check out our piece on 'Building AI to Accelerate Science' or our deep dive into 'The Generative AI Customization Spectrum.' Keeping your infrastructure secure is the foundation upon which you can build more sophisticated AI workflows.

Remember, security is not a set-it-and-forget-it task. It is a process of constant iteration. Stay alert, keep your software updated, and always question the source of any unsolicited interaction, whether it lands in your inbox or on your calendar.