KHOU warned Houston viewers on October 12, 2026: a Google Calendar invite you were not expecting can be a phishing lure for personal information.
The written account is The Guardian, October 11. A meeting, a voicemail notice, or a renewal reminder shows up on the calendar. The note asks you to open a link or call a number. Sublime Security (September 17) says this ICS pattern — calendar-file invites — jumped hard in August and September. The often-quoted ~33,000% rise from May to September is a projection from the first half of September, not a count of victims.
This is not a report that Google, Microsoft, or PayPal were hacked. Attackers send ordinary calendar invites, often from free mail, over infrastructure people already trust. The invite itself does not open your calendar. The loss starts when you click, install, or call.
We scanned theguardian.com, microsoft.com, paypal.com, google.com, khou.com, and sublime.security. 100% is the ideal overall domain-security score. None reach it.
Snapshot
| Field | Detail |
|---|---|
| Houston alert | KHOU · Oct 12, 2026 |
| Primary write-up | The Guardian · Oct 11, 2026 |
| Research | Sublime, Sept 17 · ~33,000% is a projection |
| What it wants | Fake Google, Microsoft, or PayPal login — or a “support” call |
| Report | ic3.gov if you clicked, installed, or paid |
Luke Wescott, a Sublime threat-detection engineer, told the Guardian that calendar apps such as Google Calendar can add invitations without you accepting them. Spam-foldering the email does not always keep the event off the calendar. Max Gannon of Cofense said some invites ride legitimate meeting platforms, including ones that look internal, and that blocking those platforms would also block real meetings.
Wescott’s examples of titles: “New voicemail received,” “Payment receipt confirmation – $298.99,” “PayPal unusual activity,” “Your auto-payment will be processed within 24 hours,” and a bid invitation. The next step is a fake login or a callback about a charge that never happened.
What the invite is doing
Sublime’s September spotlight describes a second path: a financial note in the invite, then a link that offers a remote-support installer (ScreenConnect class). A properly locked Microsoft environment may block that download. A weaker one, or a person who clicks through the warning, installs a tool the attacker configured. We are not linking that sample page.
Mark Morris at Sublime published the month-over-month rates the projection sits on:
| Window | Change Sublime published |
|---|---|
| June vs May | 282% |
| July vs June | 338% |
| August vs July | 1,216% |
| Sept 1–15 vs all of August | 1,426% |
| Full September vs August | 2,852% (projected) |
Those are growth rates inside Sublime’s detections. They are not a public victim total, and they are not proof Google Calendar was breached.
| Do | Why |
|---|---|
| Leave the event alone | Click, install, or call is the loss |
| Do not press Decline | Wescott: Decline can mark the address as live |
| Report, then delete | Google’s spam report is on the event menu |
| Change who can auto-add | Unknown senders should stay in email |
Stop unknown invites from landing
On a computer, open Google Calendar → Settings → Event settings → Add invitations to my calendar. Google’s invitation help offers three choices:
| Setting | What lands on the calendar |
|---|---|
| From everyone | Every invite sent to you |
| Only if the sender is known | Contacts, your organization, or someone you already dealt with |
| When I respond in email | Nothing until you answer the email |
Pick known senders or when I respond. Unknown invites then stay in the inbox, where they are easier to ignore. Google warns that known senders can tell a stranger they are not in your contacts. Events from Gmail (flights, hotels) is a separate switch and keeps working.
Classic Outlook: File → Options → Mail → Tracking, and clear Automatically process meeting requests and responses to meeting requests and polls. That checkbox is the desktop “sniffer.” Microsoft’s note says a Microsoft 365 mailbox may still process invites with the Calendar Attendant on the server, and New Outlook does not show this control — change it in Classic Outlook. Treat the checkbox as a reduction, not a guarantee.
MFA on the accounts this lure names
A hardware key or authenticator app raises the cost after someone has your password. It does not make a calendar event safe, and it does not stop a phone call or a remote-support install.
| Grade | Meaning |
|---|---|
| Fail | SMS, email OTP, or no public key / open TOTP |
| Pass | Self-serve Google Authenticator-style open TOTP |
| Strong | FIDO2 / YubiKey-class security key for sign-in |
| Platform | Grade | YubiKey | Authenticator |
|---|---|---|---|
| Google Account | Strong | Yes | Yes |
| Microsoft Account | Strong | Yes | Yes |
| PayPal | Fail | No | Yes |
| Malwarebytes Account | Fail | No | No |
| ScreenConnect console | Strong | Yes | Yes |
Google Account documents passkeys, Google Authenticator, and a YubiKey-class security key. Microsoft Account documents FIDO2 keys and authenticator-app codes. A real approval still does not unsay a calendar click.
PayPal 2-step help names Google Authenticator and Microsoft Authenticator, and it still sends codes by SMS, WhatsApp, phone, or email. That SMS/email path keeps the grade at Fail. No public YubiKey enrollment.
Malwarebytes’ own account help sends an email code on sign-in. No public YubiKey or Google Authenticator. Malwarebytes documented a March 2026 wave of fake renewal receipts dropped on calendars — an earlier shape of this same trick.
ScreenConnect account docs name a YubiKey and Google Authenticator (SMS and email OTP are also listed). Strong applies to that admin login. It does not stop someone installing a rogue agent from a calendar link. See Google-hop / ScreenConnect phishing.
Directory: MFA support directory · Email & Identity and Business Apps.
Recommended MFA tools
| Product | Best for | Get it |
|---|---|---|
| YubiKey 5C NFC | USB-C laptops + NFC phones | Amazon |
| YubiKey 5 NFC | USB-A desktops + NFC phones | Amazon |
| Proton Pass | Passkeys + authenticator-style TOTP | Proton Pass |
We may earn a commission if you buy a YubiKey or sign up for Proton Pass through the links above.
Independent cybersecurity audits
We audited the Houston station, the Guardian write-up, Sublime’s research host, and the three brands the fake logins name, on October 18, 2026. 100% is the ideal — none reach it. These scores are public email / transport / website posture. They do not mean those companies were breached.
| Organization | Domain | Overall | vs 100% |
|---|---|---|---|
| The Guardian | theguardian.com | 86% | −14 |
| Microsoft | microsoft.com | 71% | −29 |
| PayPal | paypal.com | 57% | −43 |
| google.com | 55% | −45 | |
| KHOU | khou.com | 53% | −47 |
| Sublime Security | sublime.security | 52% | −48 |
| Domain | Identity | Transport | Website |
|---|---|---|---|
| theguardian.com | 90% | 50% | 92% |
| microsoft.com | 90% | 70% | 37% |
| paypal.com | 60% | 45% | 37% |
| google.com | 50% | 70% | 37% |
| khou.com | 50% | 15% | 40% |
| sublime.security | 50% | 15% | 37% |
Audit links: theguardian.com · microsoft.com · paypal.com · google.com · khou.com · sublime.security
khou.com and sublime.security sit at 15% transport (MTA-STS / related). google.com is Identity 50%. Type calendar.google.com and paypal.com yourself — not a link inside an event you did not create.
Website stack
Passive homepage + Certificate Transparency probes (October 18, 2026). Versions only — not a claim the sites were compromised.
| Domain | Stack note |
|---|---|
| theguardian.com | CMS undetected; GlobalSign TLS expires 2027-03-05 |
| microsoft.com | CMS undetected; Microsoft TLS expires 2027-01-17 |
| paypal.com | CMS undetected; DigiCert TLS expires 2027-04-10 |
| google.com | CMS undetected; Google Trust TLS expires 2026-11-27; HTTP→HTTPS redirect not confirmed on probed hosts |
| khou.com | CMS undetected; Sectigo TLS expires 2027-04-28 |
| sublime.security | CMS undetected; Let’s Encrypt TLS expires 2026-12-12 |
Blacklist and lookalikes
Email blacklist checks (public DoH, October 18, 2026): theguardian.com, microsoft.com, paypal.com, google.com, khou.com, and sublime.security were clear on mail/domain lists we can query. khou.com, theguardian.com, sublime.security, and paypal.com showed web/CDN SPFBL on some IPs — shared-edge noise, not led.
Registered lookalikes that matter if a calendar “support” page turns into a fake portal. The scan marked one host as BEC staging (name servers plus mail, no site of its own):
| Lookalike | Technique | Signal |
|---|---|---|
| theguardian.net | TLD swap | BEC staging (NS + MX) |
| geoogle.com | insertion | NS + A + MX |
| imicrosoft.com | insertion | NS + A + MX |
| apaypal.com | insertion | NS + A + MX |
khou.org, ikhou.com, and kahou.com also resolve with mail. Google, Microsoft, and PayPal already point several defensive names (including gooogle.com, miicrosoft.com, and paaypal.com) back at the real sites. Many sublime.* names are registered with mail because sublime is a common word — that scan is not evidence those domains impersonate Sublime Security. Type the real hosts. Continuous monitoring: Cybersquat Domain Monitoring.
CourtListener searches for calendar phishing, ICS phishing, and fake calendar did not turn up a docket for this 2026 surge. The hits that came back were older, unrelated cases. This remains a consumer-alert story.
Related coverage
- Google-hop / ScreenConnect phishing
- Houston brushing / QR-package phishing
- Harker Heights Chamber festival-refund phishing
- MFA support directory
Sources: KHOU, Oct 12, 2026 · The Guardian, Oct 11, 2026 · Sublime Security, Sept 17, 2026 · Google Calendar invitation settings · Outlook sniffer / Calendar Attendant · PayPal 2-step verification · Malwarebytes calendar-renewal notice, March 2026. Independent EmailMeNow audits, website-tech, blacklist, cybersquat, and CourtListener searches October 18, 2026. Domain scores: audit.emailmenow.com only.