Hacker News Reader

Comment by andrejus | Hacker News Reader

I've received a bunch of calendar invites for "Free i PhoneXs from AppleStore" with a malicious link. Seems like this is now being used for phishing attacks.

I believe API abuse can be reported -- https://support.google.com/code/contact/cloud_platform_repor...

View on HN

Was having the same problem. Fixed it by disabling the adding events from Gmail automatically according to the Google instructions. I would rather choose what hits my calendar anyway.

https://support.google.com/calendar/answer/6084018

If people prefer a more visual guide I've created one here: https://flowshare.io/flow/how-to-block-spam-invitations-from...

I wish you could whitelist instead of just having a black or white option. My SO and parents I can trust to inject events (keeping track of stuff they've planned but I forgot is 90% of my use of Google Calendar honestly) but now that spammers have discovered Calendar as another place to spam/phish it's less hands off.

I'm getting the same spam/events. What's really weird is I'm pretty sure all of these emails are getting sent to spam but gmail/gcal is still adding the events to the calendar.

Should be opt-in if someone can just send crap to my calendar maliciously.

I can confirm it's being actively exploited this morning (I had a few folks I know complain about it). I think I should point out that the article was written in 2017 (!!!), and Google responded that this is a "feature".

Thank you to OP!

I'd never received one of these until this morning, at about the same time I read this article. Now I just received the same one as you :P

Same here! Killed my morning in to work time on train sorting this out.

I've been getting a lot more recently - seemingly being added from Gmail spam (either that or I'm getting directly injected calendar spam and the same as emails coming through). I don't want to turn off syncing as actual bookings being automatically added are useful.

I'm wondering about this as well as I've been seeing it for at least a year.

Are the events added before the email is sorted into spam? If so I wish the calender hook didn't trigger until the email reaches my "real" inbox. But I have no insight into the gmail lifecycle.

Got some too. What's super weird though, these calendar invites appear to have been sent from my iCloud email address to my gmail address, and also appear in the sent folder of my @me.com address: https://i.imgur.com/tz2TUh5.png

Anyone else can check in your gmail spam folder if you have those emails too and where they came from?

In that case, I'm going to hazard a guess that your iCloud email address was actually compromised, and is being used to send it to every address in your contacts.

Same happened to me last night, I reviewed all my access rights on security.google.com, couldn't find anything wrong. Reviewed my calendar access rights, couldn't find anything wrong.

Glad to have an explanation for this phenomenon.

Didn't expect a HN post about it so quick (fairly new here still), but yup it seems entirely spam that completely bypasses normal email filters.

I didn't either. What surprised me more is the post is from 2017.

Same thing here, exact same ad, I reported it as spam.

Invites are set up as a recurring event, so make sure to delete all the events. You can do a search to find any leftover.

If you go to the website you can mark it as spam. Then all occurrences of events from the same sender will be deleted. However there's nothing to stop spammers from sending multiple separate events from "different" senders...

I had to go into the Gmail UI to report the event as spam and seems to have fixed the issue for me.

in the process disabled the automatic fetching of events from my emails which was causing double bookings; ahh!

I just got like 10 of these iPhone ones overnight.

Got the same thing just yesterday.

Reply on news.ycombinator.com