Fortra: Calendar Phishing & ConsentFix: New Microsoft Account Threats

Name: Fortra: Calendar Phishing & ConsentFix: New Microsoft Account Threats
Uploaded: 2026-06-20T07:05:35-04:00
Duration: 1 min 53 s
Description: TL;DR Attackers are shifting from email-based phishing to 'calphishing' — using calendar invites as the primary entry point to target Microsoft accounts in less scrutinized environments. The technique combines calendar phishing with ConsentFix (devic...

Fortra

06/20/2026

0 (0%)

Report Like Favorite

TL;DR

Attackers are shifting from email-based phishing to 'calphishing' — using calendar invites as the primary entry point to target Microsoft accounts in less scrutinized environments.
The technique combines calendar phishing with ConsentFix (device code phishing) to capture session tokens through legitimate Microsoft authentication workflows, effectively bypassing MFA protections.
Campaigns show strong links to EvilTokens, an AI-enabled phishing-as-a-service platform that's rapidly gaining adoption among threat actors targeting enterprise Microsoft environments.

Summary

This threat intelligence briefing introduces a new phishing technique called 'calphishing' that exploits calendar invites to bypass traditional email security controls. Threat actors are combining calendar-based attacks with ConsentFix (device code phishing) to target Microsoft accounts, leveraging legitimate authentication workflows to capture session tokens and achieve account takeover while bypassing MFA protections. The technique is linked to EvilTokens, an AI-enabled phishing-as-a-service platform that's gaining rapid adoption. Unlike email-based phishing, calendar invites land in a less scrutinized environment and can persist even after the original email is deleted, creating multiple opportunities for user interaction. The presentation outlines how attackers abuse ICS files, manipulate Microsoft's authentication workflows, and evade standard email-focused detection systems. Organizations are advised to review the full technical analysis, IOC list, and mitigation guidance available in Fortra's detailed blog post to understand and defend against this emerging threat vector.

Chapters

0:00 - Introduction to Calendar Phishing
0:18 - Threat Intelligence Report Overview
0:44 - ConsentFix and EvilTokens Connection
1:25 - Technical Breakdown and Mitigation

Key Quotes

0:09 "Here's an interesting shift that's happening in the phishing space right now, and it starts with something that people don't really question, which is calendar invites."
0:28 "We're seeing attackers move away from traditional email-based alerts into newly discovered calphishing technique."
1:01 "The techniques help users legitimate Microsoft authentication workflows to capture session tokens and ultimately lead to account takeover, effectively bypassing MFA protections."

FAQ

How does calphishing differ from traditional email phishing?

Calphishing uses calendar invites as the primary attack vector rather than email messages. Calendar invites land in a less scrutinized environment, can persist even after emails are deleted, and bypass many email-focused security controls that organizations rely on to detect phishing attempts.

Can MFA protect against ConsentFix attacks?

No, ConsentFix (device code phishing) is specifically designed to bypass MFA protections by capturing session tokens through legitimate Microsoft authentication workflows. Once attackers obtain these tokens, they can access accounts without needing to defeat MFA directly.

Categories:

» Data Protection

Tags:

Show more Show less

TL;DR

Summary

Chapters

Key Quotes

FAQ

Safeguarding Sensitive Data in the Age of AI Platforms

AI Agents Revolutionizing Identity Attacks: Same Tactics, Enhanced Speed

Harnessing AI for Secure Innovation in the Enterprise with Netskope & Omada