chat
expand_more

Attackers Disguise Malware as Calendar Invite Attachment

Meeting invites are one of the most common types of emails sent today, so it should come as no surprise that attackers have found a way to manipulate them. Scores of recipients that utilize Abnormal Security recently received emails that contained a .ics attachment—an invitation file commonly used to populate online calendar applications with meeting and event information.
December 9, 2021

Meeting invites are one of the most common types of emails sent today, so it should come as no surprise that attackers have found a way to manipulate them. Multiple organizations that utilize Abnormal Security recently received emails which contained a .ics attachment—an invitation file commonly used to populate online calendar applications with meeting and event information.

The potential danger arises when a user clicks on the supposed ICS file, unknowingly commencing the process to download malware exploiting the Dynamic Data Exchange (DDE) vulnerability present in Microsoft applications.

About the Calendar Invite Attack

First discovered in summer 2021, calendar invite attacks (CIAs) have been increasingly targeting Abnormal customers across a wide range of industries. Unlike credential phishing attacks, which request a recipient’s login credentials for a popular email service provider or other service, calendar invite attacks are disguised as ICS files, which are commonly used to reserve time on the recipient’s calendar application for an event such as a Zoom or Microsoft Teams meeting.

Unfortunately, the popularity of hosting events or holding meetings virtually makes it easier than ever for bad actors to persuade recipients into clicking a malicious attachment masquerading as a calendar invite file. In this example, the email simply states “download to read” and includes an ICS file attachment.

Calendar invite email with a disguised ICS file

Because the attachment is a known file type, these attacks bypass traditional email security tools and may trick recipients into opening them, believing the file type to be safe.

Calendar invite email ICS attachment

Using Social Engineering for ICS Attacks

Before analyzing the contents of the malware, let’s take a look at the social engineering techniques involved in this attack. In this campaign, attacks with the same subject line were sent to various types of organizations, including media companies.

It would not be unforgiving to speculate that, given the subject line and the sender domain, the recipient was perhaps expecting information regarding a judgment for an employee against a school district in California, as noted in this article. By targeting those who would be most interested in the information, the attacker encourages recipients to click—ultimately downloading the malware that has bypassed security filters with its ICS file type.

Making it even harder to detect, the attack passed authentication from the sender domain. Further analysis by Abnormal shows that the messages were sent from numerous different country domains, including India, Italy, and South Korea, all containing vague and succinct language that was followed by a .ics attachment ready to be downloaded.

The Virus That Evades Antivirus

What makes this attack quite dangerous when compared to others is how much more covert it is. The bad actor simply has to find a way to force the recipient into commencing the Dynamic Data Exchange (DDE) protocol, a protocol in which a plethora of Microsoft applications use to communicate with one another, and provide a prompt to ask the user whether they would like the application to run. The most active portion of the code has been highlighted below.

Calendar invite malware code

Upon completion, the malware has been installed after which the threat actor can perform a variety of nefarious acts.

Detecting and Removing the Calendar Invite Attack

Fortunately for the customer described in this scenario, the attack was stopped within nine seconds of reaching the user’s mailbox. It was remediated once again when a carbon copy of the attack was received by the same user five days later.

How Abnormal Prevents Malware Attacks

And it appears that this attack type may not be going away in the near future, as cybercriminals have found a new way to bypass secure email gateways. After all, ICS files are used in millions of legitimate emails each day, and recipients are likely to click on something they see as familiar.

In the dozens of calendar invite attacks that have been found since, Abnormal’s machine learning algorithm and security analysts worked in tandem to label each calendar invite attack as malicious, remediating it from the recipients' inboxes before the malware could be accessed.

To learn how Abnormal detects ICS file attacks, without blocking all calendar invitations sent to your organization, request a demo today.

Attackers Disguise Malware as Calendar Invite Attachment

See Abnormal in Action

Get a Demo

Get the Latest Email Security Insights

Subscribe to our newsletter to receive updates on the latest attacks and new trends in the email threat landscape.

Get AI Protection for Your Human Interactions

Protect your organization from socially-engineered email attacks that target human behavior.
Request a Demo
Request a Demo

Related Posts

B 07 22 24 MKT624 Images for Paris Olympics Blog
Threat actors are targeting French businesses ahead of the Paris 2024 Olympics. Learn how they're capitalizing on the event and how to protect your organization.
Read More
B Cross Platform ATO
Cross-platform account takeover is an attack where one compromised account is used to access other accounts. Learn about four real-world examples: compromised email passwords, hijacked GitHub accounts, stolen AWS credentials, and leaked Slack logins.
Read More
B Why MFA Alone Will No Longer Suffice
Explore why account takeover attacks pose a major threat to enterprises and why multi-factor authentication (MFA) alone isn't enough to prevent them.
Read More
B NLP
Learn how Abnormal uses natural language processing or NLP to protect organizations from phishing, account takeovers, and more.
Read More
B DK Compromise 7 11 24
Discover the top five ways hackers compromise accounts, from exploiting leaked API credentials to SIM swapping partnerships, and more. Learn how these techniques enable account takeover (ATO) and pose risks to enterprises.
Read More
B Sans Recap 7 11 24
Discover trends among modern SOC teams, including misaligned budgets, increased automation, unsatisfactory AI tools, staffing issues, and more.
Read More