That Google Calendar Invite Wants Your Password. Do Not Give It One.
There is a phishing campaign going around right now that targets Google Calendar. And the reason it caught my attention is that it actually gets past multi-factor authentication. That is a big deal.
How This Thing Works
You get a calendar invite. It looks normal enough. But somewhere in that flow, it asks you to authenticate. You plug in your password. You plug in your MFA code. And at that point, it steals the session tokens sitting on your computer. Once it has those, it does not need your password anymore. It just becomes you on your Google account.
My first reaction when I read this was: why would anybody type their password into a calendar invite? No other calendar invite has ever asked you to do that. Not one. So if a request comes in and suddenly it wants you to log in, that is your signal to stop and close the window.
What We Found When We Checked Our Own Coverage
After I read this, I went straight to our SaaS security tool and asked whether we had this covered. It came back with a detailed report. The short version: we had six of the eight attack vectors in this campaign covered. Not bad, but not complete. So it also gave us three additional things we can do to close the gap, and we are working through what those mean and how they affect our setup.
If you have SaaS security in place, there is a good chance it stops most of this. If you do not have anything protecting your cloud apps, then yes, this can happen to you, and you would not necessarily know until it was too late.
What You Should Do
- Train your staff: no Google Calendar invite should ever ask for a password or an MFA code. If one does, do not touch it.
- If you are on Google Workspace and you do not have SaaS security on top of it, that is the gap to fix first. Your cloud apps are the keys to the kingdom for a lot of businesses.
- If you are not sure what you have or whether it covers this, give me a call and we will take a look.
And honestly, if you are running your whole business on Google and you have no additional security layer around it, that is the bigger conversation we should be having.
Questions about how this affects your setup? Schedule a free IT consultation and we’ll walk through it with you.
Wherever your team is based, ACS provides hands-on managed IT support — see how we help businesses in Traverse City & Northern Michigan.