Reporting describes growing phishing activity that uses calendar invitations to lead recipients to fake login pages. Attacks observed by Sublime in August increased 1,216% over the previous month, but that reflects the company’s detections rather than all calendar traffic. Attackers exploit invitations appearing automatically on calendars as seemingly legitimate appointments. Users should review automatic-add settings for unfamiliar invitations, check link domains, and remain alert to invitations from compromised contacts. Passkeys can help against fake login pages because they are bound to their registered domains.