AI Phishing Attacks: What Changes for Employees

Picture a finance clerk opening the calendar before a Monday payment run. Between two real meetings sits an event nobody accepted, "Final Notice: Payroll Acknowledgment Required," with a link in the description, and nothing was clicked or downloaded to put it there. This is calendar phishing, and this post is for security awareness managers in the UAE and GCC who need to explain it to staff and test for it.

‍

In short: Calendar phishing puts a fake event on a calendar through an invite file, so staff meet it inside a trusted app. Train people to treat unexpected invites like unexpected email, report them, and test them with realistic simulations.

‍

How Calendar Phishing Works

Attackers email a calendar file, usually with the .ics extension, and the event can land on the recipient's calendar without any action from them, as an IT security notice from a New York college describes. Because the event sits inside an app people trust, and the invite can get past email filters, it is harder to spot than a message in a spam folder.

‍

The event itself carries the lure. Titles borrow urgency from finance, such as an invoice, an overdue payment or a crypto purchase, and the description pushes the reader to click a link, open a file or call a phone number, as a university warning from October 2025 lays out. Some invites appear to come from the organization's own domain while the real sender is someone else.

‍

That makes calendar invite phishing a different problem from the phishing email staff already learn to distrust. The reader never decides to open anything. The first decision they make is what to do with an event that is already there.

‍

Why ICS Phishing Reaches Staff Unchecked

Many calendar apps can add invitations on their own, which is why these events often appear without the recipient doing anything, as the college notice puts it. So the setting that decides whether a fake invite appears at all often belongs to IT, not to the employee.

‍

The New York college changed its domain-wide settings so that invitations from external senders staff had never interacted with no longer appear until they accept them. It still asked staff to set their own calendars to add invitations only if the sender is known. Settings cut the volume. A person still has to judge what remains, including invites that look like they come from inside the organization.

‍

Attackers are also moving away from the inbox in general. The 2026 Verizon Data Breach Investigations Report reports that mobile social engineering, such as fake texts and voice calls, has a success rate 40% higher than traditional email phishing. A calendar event is another place outside the inbox where a lure can arrive, and an invite that asks the reader to call a number borrows the same phone-based pressure.

‍

‍

What Malicious Meeting Invitations Look Like

The warnings from the college and the university list the same few signs. Staff can check them in seconds:

‍

• An organizer they do not know, or a familiar name with an address that does not match
• Money words in the title: invoice, overdue payment, payroll, crypto
• Urgent wording such as "payment will be processed within hours"
• A link or attachment that asks for login details
• A phone number in the description

‍

None of this needs technical knowledge. It needs a pause, and the pause is what training has to build, because an event already on the calendar feels as if someone has accepted it.

‍

Train Staff to Spot Fake Invites

Teach the report path first. Both institutions tell staff not to click links, open attachments or call numbers in an unexpected event, and to report it as spam before deleting it. Staff need that exact sequence in the language they work in, on the calendar they use. Codex delivers micro-learning in Arabic and English for this kind of habit.

‍

Simulate the channel. Training explains the risk. A simulation shows what people do when an invite appears on a Monday morning. Whitebait runs phishing simulation for UAE and GCC organizations in Arabic and English and tracks the reporting rate next to the click rate, which is the pair of numbers to read after an invite test. Base the invite on a real example from a public warning.

‍

Match the lure to the role. A finance clerk sees invoice and payment invites, an HR officer sees payroll acknowledgements, and an executive assistant who manages other people's calendars accepts invites all day. Each role needs its own version of the test.

‍

Calendar invites are one of several places where a fake request arrives inside a trusted app. Our post on fake helpdesk chats in workplace messaging covers one of the others, and the post on AI phishing attacks covers how better written lures change what employees see.

‍

Run One Calendar Test This Month

Go back to the finance clerk's Monday. Ask IT whether invitations from unknown senders add themselves to calendars in your organization, and set the known-senders rule if you can. Then send one simulated invite to a single team and compare how many people report it with how many click. The result shows which team needs training first.

‍

Frequently Asked Questions

What is calendar phishing?

‍

Calendar phishing uses a calendar invite, often an .ics file, to place a fake event on a victim's calendar. The title creates urgency, and the description holds a link, an attachment or a phone number. Because the event appears inside a trusted app, staff may trust it more than a suspicious email.

‍

Can a malicious invite do harm without a click?

‍

The fake event can appear without any action from the recipient, but the harm starts when someone clicks a link, opens an attachment or calls the number in it. Staff who leave the event alone and report it have avoided that lure, which is why reporting habits matter more than spotting every invite.

‍

How can IT reduce calendar invite phishing?

‍

Check whether your calendar platform adds invitations automatically and which option it uses. Where it is available, limit automatic additions to known senders so that events from strangers do not appear until someone accepts them. Administrators can often apply this across the whole organization, as the New York college did for external senders.

‍

What should an employee do with a suspicious invite?

‍

Do not click links, open attachments or call numbers in the event. Report it as spam using the calendar's report option, then delete it. If they already clicked or entered credentials, they should reset the password at once and contact the security team.

‍

How do you test staff for ICS phishing?

‍

Send a simulated invite with a realistic title and link to a small group chosen by role, such as finance or HR. Measure how many people report it next to how many click, then repeat with a different lure so staff learn the pattern and not one wording.

The FBI has warned that attackers are emailing a short code and telling the reader to enter it on a real Microsoft page. Device code phishing works because nothing on that page is fake, which is why it slips past the habits most employees have learned. This post is for SOC leads and security awareness managers who need to explain the lure in plain terms.

‍

In short: A device code lure asks you to type a code, sent by someone else, into a genuine Microsoft sign-in page. That approves the attacker's device, not yours. Employees should never enter a code they did not request themselves, and should report the message.

‍

How the Device Code Lure Works

Device codes exist for devices that are awkward to type on. A smart TV or a printer shows a short code, and you enter it on a phone or laptop to approve the sign-in. The standard behind it, RFC 8628, published in August 2019, warns that the flow can be started on a device in an attacker's possession.

‍

OAuth device code phishing turns that design against the user. It runs in four steps:

‍

1. The attacker asks Microsoft for a device code, which expires after about 15 minutes.
2. A message gives the code to the target with a reason to enter it, such as a shared document, an invoice, a meeting ID or a security check.
3. The target opens the real Microsoft device login page, types the code, signs in and approves MFA as usual.
4. The attacker's device receives access and refresh tokens and can read mail and files without ever seeing a password.

‍

Email is only one route. CyberScoop reported in February 2025 that a campaign attributed to a suspected Russia-aligned group, aimed at governments and organizations in regions that included the Middle East, built rapport over messaging apps such as Teams, WhatsApp and Signal, then sent fake Teams meeting invitations that presented the code as a meeting ID.

‍

Why Microsoft 365 Device Code Phishing Works

Most awareness advice tells people to check the address bar and distrust unfamiliar login pages. In Microsoft 365 device code phishing the address bar is correct and the page belongs to Microsoft. The employee follows the advice and still hands over access.

‍

The FBI describes a phishing-as-a-service kit that captures access and refresh tokens and gets around MFA without intercepting the user's credentials, because the victim approves the sign-in themselves. In May 2026 Australia's national cyber agency said it had received a number of reports of the same activity against Microsoft 365 users, as Information Age reported.

‍

The scale is already large. A research note from the Cloud Security Alliance reports 340 or more Microsoft 365 organizations in five countries hit by one phishing-as-a-service campaign by mid-March 2026, across construction, manufacturing, financial services, healthcare and local government. That is less than seven years after the device code standard was published.

‍

‍

That scale explains why response matters as much as prevention. The same research note says a password reset alone does not end access, because the stolen refresh token keeps working until sessions are revoked.

‍

What Employees Should Never Enter

Give people a rule short enough to remember at their desk, and put it where they sign in:

‍

• Never enter a code on a Microsoft page that someone else sent you, whatever the message calls it: one-time password, access code, verification token or meeting ID.
• Never approve a sign-in you did not start yourself.
• Treat any request to verify a document, invoice or meeting by typing a code as a lure, even when the page is real.
• Report the message instead of replying, and say whether you already entered a code.

‍

The last line matters most to the SOC. An employee who reports within minutes gives your team time to revoke sessions and review registered devices, mail forwarding rules and OAuth consents, which are the response steps the Cloud Security Alliance note lists.

‍

Device Code Phishing Awareness in Practice

Knowing the rule is different from applying it when a message appears to come from a finance director on the day of a payment run. A phishing simulation that asks employees to type a code or approve a sign-in shows you who stops and who reports. Whitebait runs MFA bypass scenarios in Arabic and English and tracks reporting rate next to click rate, which tells you whether the rule held.

‍

Role matters here. Finance staff, executive assistants and help desk teams handle the documents and meeting invites that lures imitate, so they should see harder and more frequent scenarios. Add short training in Arabic and English through Codex, and give people a one-tap way to report from inside Microsoft Teams with the Fraus Teams App. The chat version of this pattern is covered in Microsoft Teams phishing.

‍

Controls That Back the Rule Up

Awareness works best next to configuration. The FBI recommends a conditional access policy that blocks device code flow for all users, with narrow exceptions for documented business needs, and an audit of current use first so legitimate dependencies are found.

‍

Blocking the flow removes the lure's payoff. Training then covers the cases the policy cannot, such as an exception you had to keep or a different sign-in prompt built on the same trick.

‍

A Practical Next Step

Picture the accounts payable clerk who receives a message asking for a code to open an invoice. This week, ask your identity team whether anyone still uses device code sign-in, and send employees the four-line rule above.

‍

Then schedule a simulation for the roles most exposed and compare reporting rate with click rate after the first round. That gives you a number to take to the next security review.

‍

Frequently Asked Questions

What is device code phishing?

‍

It is an attack that abuses the device sign-in feature. The attacker starts a sign-in on their own device, then convinces a victim to enter the matching code on the real Microsoft page. The victim's approval gives the attacker tokens for the account, with no fake website involved.

‍

Does MFA stop device code phishing?

‍

Not on its own. The victim completes MFA while approving the attacker's request, so the prompt is genuine. The FBI notes the kit it describes gets around MFA without intercepting the user's credentials. Blocking device code flow with a conditional access policy removes the payoff for most users.

‍

Is device code phishing a Microsoft vulnerability?

‍

No. The Australian Signals Directorate said it is not a technical flaw in Microsoft systems, as Information Age reported. Attackers abuse the legitimate Microsoft login page. The feature works as designed, which is why user behavior and policy controls both matter.

‍

What should an employee do after entering a code?

‍

Report it to the security team immediately and do not wait to see whether anything happens. The SOC can revoke the account's sessions, check for new registered devices and mail forwarding rules, and review OAuth consents. A password change alone will not remove the attacker.

Microsoft Teams phishing often starts with a chat message from someone who says they work in IT support. In April 2026, news reporting described security researchers tracking intrusions that began this way, with an outside account contacting employees about an account problem or a security update. This post is for security awareness managers who need to explain the pattern to staff and give them a clear way to verify and report it.

‍

In short: attackers message employees from outside the organization, pose as the helpdesk and ask for remote access. Employees stay safe when they check the external label, confirm the request through a channel they start themselves, and report the chat at once.

‍

How Teams Phishing Attacks Unfold

The reported pattern is simple. An account outside the victim's organization opens a chat, claims to be helpdesk staff and says something needs fixing. The pretext is an account issue or a security update, and the ask is to start a remote support session so the "technician" can help.

‍

That session is the whole point. Once the employee hands over control of their machine, the attacker works from inside a trusted device. The researchers described the steps that followed: reconnaissance on the machine, malicious files placed in folders the user can write to, persistent access, movement to other systems, and data copied out to external cloud storage.

‍

Nothing in that chain needs a malicious attachment or a lookalike login page. It needs one employee to say yes to a friendly request, which is why these Teams phishing attacks are a human problem before they are a technical one.

‍

Why Microsoft Teams Phishing Works

Staff learn to distrust email from strangers. Teams feels different, because it is the place where colleagues, managers and the real helpdesk already talk. A chat window carries an unspoken sense that the sender belongs there, and a short, polite message from "IT" matches how internal support really sounds.

‍

The numbers behind the wider problem are consistent. Verizon's 2026 Data Breach Investigations Report found the human element was present in 62% of breaches, up slightly from 60% the year before.

‍

‍

Verizon also reports that in phishing simulations the median click rate for mobile-centric lures such as voice and text messages is 40% higher than for email. Teams chat is not a text message, but the lesson carries over: lures that arrive as a conversation, in real time, are harder to resist than a message that sits in an inbox.

‍

Spotting Teams Helpdesk Impersonation

Teams already gives employees one reliable signal. Microsoft's documentation says an external label appears at the top of a chat when it includes participants from outside the organization, and a label also sits beside their names. Researchers advise treating external Teams contacts as untrusted by default, and staff should be told the same thing in plain words.

‍

A helpdesk contact that shows the external label and claims to be your own IT team is already a mismatch. Beyond that, give employees a short routine to run before they respond:

‍

• Look for the external label on the chat and beside the sender's name.
• Be wary of urgency: a locked account, an expiring password or a security update that must happen now.
• Never start a remote support session, read out a code or share a password because a chat asked you to.
• Confirm the request through a route you start yourself, such as a ticket in the service portal or the helpdesk number on the intranet.
• Stop replying, and report the chat.

‍

Publish the routine in Arabic and English, with screenshots of how the label looks in each Teams display language your staff use.

‍

Reporting a Suspicious Chat

Verification protects one employee. Reporting protects everyone else, because the same account usually messages many people in the same week. If the first person to see the chat reports it quickly, the security team can warn colleagues, block the sender and check whether anyone already accepted a remote session.

‍

Reporting has to be easier than ignoring. The Fraus Teams App puts one-tap phish reporting inside Microsoft Teams, next to Odin risk scores, policy acknowledgement and micro-training, so an employee can raise the alarm without leaving Teams.

‍

Tell staff what happens after they report: who reads it, how fast they will hear back, and that nobody is blamed for reporting a chat that turns out to be harmless. People report more when the answer is a thank you.

‍

Training for Microsoft Teams Social Engineering

One awareness slide will not hold up against Microsoft Teams social engineering, because the lure changes with each attacker. Training works better when it is matched to the person. Helpdesk staff, finance teams and executives face different pretexts, and each group should see examples that look like their own working day, in Arabic and in English.

‍

Pair that with measurement. A phishing simulation platform such as Whitebait tracks reporting rate next to click rate, and the reporting rate is the number that tells you whether staff would raise a fake helpdesk chat. Short micro-learning in Codex, in Arabic and English, can then follow up with the people who show a gap.

‍

Your Next Step

Picture the employee from the opening, looking at a chat from "IT" about a security update. This week, write the one-page routine above, agree who owns reports of suspicious chats, and tell staff how fast they will get an answer.

‍

Then check that every employee can find the report button in under ten seconds. If they cannot, fix that before you add more training.

‍

Frequently Asked Questions

What is Microsoft Teams phishing?

‍

It is the use of Teams chats, calls or meeting invites to trick employees into giving up access, credentials or data. A common version is a fake helpdesk contact from an outside account that asks the employee to start a remote support session or approve a security update.

‍

How do I know a Teams message is from a real helpdesk?

‍

Check for the external label first. Then confirm through a route you start yourself, such as a ticket in the service portal or the helpdesk number on the intranet. Do not rely on the chat itself to prove who the sender is.

‍

Should employees ever accept a remote session from a Teams chat?

‍

Not from an unsolicited chat. Your policy should state that remote access is only granted for a request the employee raised themselves, through an approved channel. Anything else is treated as suspicious and reported.

‍

How should employees report a suspicious Teams chat?

‍

They should stop replying and report it straight away through the route your security team has set. The Fraus Teams App offers one-tap phish reporting inside Microsoft Teams, so reporting takes seconds and happens inside Teams.

‍

Can phishing simulation cover Teams helpdesk impersonation?

‍

Simulation builds the habit the attack tests: pausing, verifying and reporting. Track reporting rate and time to report next to click rate, and use role-based scenarios so helpdesk-style pretexts reach the people they would target.