Phishing hides in routine Microsoft 365 workflows

1. Executive summary

Adversaries are abusing native Microsoft 365 collaboration surfaces — Outlook Groups, shared files, and calendar invitations — to deliver phishing lures that blend into routine productivity workflows. The technique, tracked by Fortra under the "CalPhishing" label, seeds a victim into an attacker-controlled M365 Group, then escalates through group mail, shared documents, and .ics calendar events themed around payroll, contracts, supplier requests, or mandatory training. Final-stage actions can lead to credential theft, OAuth token theft (consistent with the separately-reported Kali365 PhaaS pattern), macro/malware delivery, or further social engineering. For EMEA financial services, the risk is concentrated account takeover of M365 tenants that hold mail, Teams, OneDrive, and downstream federated SaaS — with downstream fraud (wire fraud, supplier-impersonation, mailbox-rule abuse) as the realistic business impact.

2. Regulatory framing

3. Technical analysis & attack chain

1. Initial access — group seeding. The attacker adds or invites the target into an attacker-controlled Microsoft 365 Group. The group name, description, or welcome message is themed for urgency (payroll, contract renewal, supplier request, mandatory training).
2. Trust establishment. The group mailbox, shared files, and calendar invitations appear inside native M365 surfaces, so the lure is delivered through a trusted productivity workflow rather than a single suspicious email.
3. CalPhishing delivery. One of four CalPhishing techniques is used: meeting invitations or .ics files that place events directly on the victim's calendar. The event can sit unopened for days while reminders keep it visible.
4. Shared-file escalation. A "clean" group email can lead to a shared document containing a fake support process, QR code, credential-harvesting page, macro lure, or remote-access instruction.
5. User action. The victim is prompted to review a document, approve a request, sign in to an account, or download a file.
6. Final impact. Outcomes include credential theft, OAuth/access-token theft, malware delivery, data exposure, or further social engineering.

Technical specifics that matter to a defender

• Vector: abuse of native M365 collaboration surfaces (Groups, shared files, calendar) rather than a direct malicious attachment or link from an external sender.
• Lure format: .ics calendar files and meeting invitations delivered via group mailboxes; shared documents hosted inside M365 (OneDrive/SharePoint) so URLs resolve to *.sharepoint.com, *.onedrive.com, or *.office.com tenants.
• Theming observed: payroll updates, contract renewals, supplier requests, mandatory training notices.
• Persistence mechanism: calendar reminders and group mailbox threads keep the lure visible over time, increasing the chance the victim eventually interacts with it.
• Token-theft pathway (consistent with the separately-reported Kali365 pattern): the lure can direct the victim to a real Microsoft device-code sign-in URL (https://microsoft.com/devicelogin and equivalents) and request a short device code. Approval yields OAuth access and refresh tokens tied to the victim's M365 account, enabling long-term access until tokens are revoked or expire.
• Post-access capability: with valid refresh tokens, attackers can read mail, send new mail from the victim's address (enabling further internal and external compromise), and access Outlook, OneDrive, Teams, and other M365 services without re-entering a password.
• Investigation friction: activity is spread across email, M365 Groups, shared files, and calendar events, complicating triage and timeline reconstruction.

Unconfirmed / single-sourced claims. The CalPhishing taxonomy and the four underlying techniques are described by Fortra in a single source; the specific count and naming of "four techniques" should be treated as analyst framing rather than independently corroborated. The link between this CalPhishing pattern and the Kali365 PhaaS is contextual — both abuse M365 trust surfaces, but no source confirms they are operated by the same actor or share infrastructure.

4. Mitigation & containment

P1 — within 24 hours

• Block external group additions by default. In Microsoft 365, restrict who can add external users to groups: Azure AD portal → Groups → General → Users can add guests to groups = No; or via Graph: Update allowedToAddGuests on each group. Disable the "Let group owners add people outside the organization" setting tenant-wide.
• Restrict external calendar invitations. Set Restrict receiving calendar invitations from external senders in Exchange Online to Block invitations from external senders for high-risk user populations (Treasury, AP, HR, execs).
• Disable email auto-add of calendar events from external senders and require explicit accept.
• Audit and remove any M365 Groups created in the last 90 days that have external owners or that the tenant did not intentionally create. Use: Get-MgGroup -Filter "createdDateTime ge 2026-03-25" | Get-MgGroupMember -All and review owners.
• Revoke refresh tokens for any account that interacted with a suspected lure: Revoke-AzureADUserAllRefreshToken -ObjectId <UPN> in Azure AD; force re-auth and password reset.
• Hunt for suspicious .ics opens in M365 audit logs (AuditLogSearch for Outlook\Calendar\CalendarItem\Open events tied to external organizers).

P2 — within 72 hours

• Conditional Access hardening. Require MFA + compliant device for all M365 access; block legacy auth; require phishing-resistant MFA (FIDO2/Windows Hello/Platform passkeys) for finance and exec populations.
• Disable OAuth consent for third-party apps by default; require admin consent for any new app registration. Audit existing grants: Get-MgServicePrincipal and review permissionScopes.
• Enable and tune Microsoft Defender for Office 365 Safe Links / Safe Attachments policies to detonate .ics-hosted URLs and shared-file URLs from unknown external sources.
• Mailbox rule audit. Run Get-InboxRule across the tenant and remove auto-forwarding or "move to folder + delete" rules that hide attacker replies.
• Tenant lockdown. Disable external sharing for SharePoint/OneDrive sites that do not require it; require approval for external sharing on the rest.

P3 — within 7 days

• User awareness. Targeted phishing simulation using the exact CalPhishing pattern (group invite → .ics → shared file with credential prompt) for finance, HR, and exec teams.
• Logging. Confirm M365 unified audit log is enabled and retained ≥ 90 days; forward to SIEM with rules for group-creation, external-guest-add, and .ics open events.
• Vendor posture review. Validate Microsoft contractual clauses (Art. 30) cover audit log access, incident cooperation, and data residency for the affected workloads.

5. Indicators of compromise

lure-format  .ics calendar invitations delivered via M365 Group mailbox
lure-theme  payroll updates, contract renewals, supplier requests, mandatory training notices
lure-content  shared documents containing fake support process, QR code, credential-harvesting page, macro lure, or remote-access instruction
lure-url-pattern  https://microsoft.com/devicelogin (real Microsoft device-code sign-in URL used to harvest OAuth tokens)

6. Detection

rule AT_2026_06_23_CalPhishing_Lure_Artefacts
{
  meta:
    author = "Adverse Trace"
    date = "2026-06-23"
    description = "Strings associated with CalPhishing lures delivered via M365 Groups, shared files, and calendar invitations"
    reference = "https://www.helpnetsecurity.com/2026/06/23/microsoft-365-collaboration-features-phishing/"

  strings:
    $ics_ext = ".ics" ascii nocase
    $theme_payroll = "payroll" ascii nocase
    $theme_contract = "contract renewal" ascii nocase
    $theme_supplier = "supplier request" ascii nocase
    $theme_training = "mandatory training" ascii nocase
    $content_qr = "QR code" ascii nocase
    $content_macro = "macro" ascii nocase
    $content_remote = "remote access" ascii nocase
    $content_support = "support process" ascii nocase
    $devicelogin = "microsoft.com/devicelogin" ascii nocase

  condition:
    any of ($ics_ext, $devicelogin) or 2 of ($theme_*, $content_*)
}

title: M365 External Group Addition Followed by Calendar Invite Open
id: AT-2026-06-23-001
status: experimental
description: Detects a user being added to an external M365 Group followed shortly by opening a calendar item from that group's organizer.
author: Adverse Trace
date: 2026-06-23
references:

  - https://www.helpnetsecurity.com/2026/06/23/microsoft-365-collaboration-features-phishing/
logsource:
  product: m365
  service: audit
detection:
  selection_add:
    eventSource: "AzureActiveDirectory"
    operation: "Add member to group"
    targetResources.type: "Group"
    targetResources.modifiedProperties.displayName: "members"
  selection_calendar:
    operation: "Outlook\\Calendar\\CalendarItem\\Open"
  filter_external_organizer:
    organizerDomain: "*"
  timeframe: 24h
  condition: selection_add and selection_calendar and filter_external_organizer
falsepositives:

  - Legitimate external collaboration with vetted partners
  - Vendor onboarding flows that intentionally add external guests
level: high

7. Sources

• Help Net Security — Phishing hides in routine Microsoft 365 workflows (Fortra research, Daud Jawad quote) — https://www.helpnetsecurity.com/2026/06/23/microsoft-365-collaboration-features-phishing/ — 2026-06-23
• Malwarebytes Labs — Kali365 phishing kit bypasses MFA and steals Microsoft logins — https://www.malwarebytes.com/blog/scams/2026/05/kali365-phishing-kit-bypasses-mfa-and-steals-microsoft-logins — 2026-05

8. Adverse Trace position

Severity is moderate-to-high for EMEA financial services: the technique exploits trusted M365 surfaces, the lure can persist for days via calendar reminders, and a successful click can yield long-lived OAuth refresh tokens that bypass MFA and enable mailbox-rule abuse, supplier-impersonation fraud, and lateral movement into federated SaaS. No CVSS score is applicable (no CVE); no named threat actor has been attributed in the source material, so any attribution should be treated as unconfirmed. We will (a) push the Sigma rule into the EMEA detection baseline, (b) assist clients with the P1 group-add and calendar-invite hardening, and (c) deliver a targeted CalPhishing simulation to finance, HR, and exec populations within 7 days.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.