Warning against "calendar spam" requests  [08.04.21]

CERT BWL warns that since the beginning of April, an increasing number of Outlook requests (appointment invitations) have been sent for calendar series that are to be classified as spam. These requests may be entered in the calendar with the status "subject to change".

The sender is an external email address, and the subject is, for example, Meeting Request: Invitation: [%NAME]:It's time to act! at Sun, 04.04.2021 (UTC+01:00), All Day, Weekly;
The actual message contains, among other things, the following text block: When: Takes place every Sunday effective 04.04.2021. UTC *~*~*~*~*~*~*~* <meeting.ics>

On iOS, for example, the entry cannot be removed, you can only click "Accept", "Maybe" or "Reject". But this leads to the fact that the sender is informed about the action and possibly so your email address is confirmed as actually existing. Under Windows in Outlook the appointment series can be deleted. You can also determine here whether the sender is informed about it.

CERT BWL assessment and recommendation for action
There are currently no signs of malicious code spreading via these meeting requests. If you receive meeting requests of this type, please delete them immediately - ideally via Outlook (right-click to delete and do not send a reply), not via your mobile device.

Also, please do not click on links within the Outlook request.

If you have any questions, please email the KIM.

Back to All news