Phantom/Phishing/Spam Calendar invites in Google Calendar

We want to inform you about a Google Calendar setting that automatically adds meeting invitations from Gmail to your calendar. Recently, this feature has been exploited to add fake meetings containing malicious links to calendars.

While we cannot universally control this setting, you can adjust it individually. Please visit your Google Calendar settings at https://calendar.google.com/calendar/u/1/r/settings and scroll down to the “Add invitations to my calendar” section.

The default option, “From everyone,” is vulnerable to this type of attack. We recommend changing this setting to either “Only if the sender is known” or “When I respond to the invitation in email.” The latter is the most secure option, though it requires you to monitor your email more closely for invitations. I have personally chosen the “Only if the sender is known” option. The downside is that you may miss invitations. 

For your reference, here are the descriptions of each option:

• From everyone: Adds all invitations to your calendar.
• Only if the sender is known: Adds an invitation to your calendar only if the sender is in your contacts or if you’ve interacted with them before. Please note that this might reveal to senders that they are not in your contacts.
• When I respond to the invitation in email: Adds an invitation to your calendar only when you respond to the invitation in email.