Apple iCloud Calendar phishing scam bypasses spam filters to steal data

Phishing attacks are becoming increasingly sophisticated, and the latest scam takes exploitation of a trusted platform to a new level. Instead of sending generic or suspicious-looking emails, attackers are now abusing Apple’s iCloud Calendar invite system to deliver phishing content directly from Apple’s own email servers.

This clever tactic allows the fraudulent messages to bypass spam filters and appear more legitimate to unsuspecting users. The goal is to alarm you into calling a scammer’s fake support number under the pretense of disputing a fraudulent PayPal transaction. Once contacted, you are manipulated into granting remote access to your devices or sharing sensitive data.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

NEW EVITE PHISHING SCAM USES EMOTIONAL EVENT INVITATIONS TO TARGET VICTIMS

How the scam uses iCloud Calendar invites to bypass security

The heart of this scam lies in abusing Apple’s official infrastructure to lend credibility to a phishing attempt. Instead of using a suspicious or easily flagged email address, the attackers send calendar invites from Apple’s genuine domain, noreply@email.apple.com, as reported by Bleeping Computer.

The attacker embeds the phishing message in the “Notes” section of the calendar event, making it appear as a legitimate notification. They send the calendar invite to a Microsoft 365 email address they control, which is part of a mailing list. As a result, the invite is automatically forwarded to multiple real targets, broadening the scam’s reach.

Typically, when emails are forwarded, SPF (Sender Policy Framework) checks fail because the forwarding server isn’t listed as an authorized sender. However, Microsoft 365 uses a technique called the Sender Rewriting Scheme (SRS), which rewrites the return path so that the message still passes SPF checks.

This makes the email appear fully legitimate to both the recipient’s inbox and automated spam filters. As a result, the message is far more likely to reach a user’s inbox without being flagged, increasing the chance the victim will take the bait.

SCAMMERS ARE USING DOCUSIGN…