iPhone Calendar Scam: A New Phishing Threat Targeting Apple Users
Cybersecurity researchers have issued a stark warning to iPhone and iPad users about a rapidly spreading scam that exploits calendar invites. This deceptive scheme floods victims' calendars with fake alerts, designed to scare or manipulate them into surrendering sensitive personal information, such as passwords and banking details. Unlike traditional malware, this attack does not require installing any app or downloading software, making it particularly insidious.
How the Scam Operates
The attack is typically triggered when users accidentally click on a malicious link online. Once activated, scammers trick victims into subscribing to a hidden calendar through deceptive pop-ups. After subscription, attackers can push unlimited notifications directly to the device, bypassing the App Store's security controls. These alerts often masquerade as urgent security warnings, prize notifications, or fake system messages, appearing official and difficult to distinguish from legitimate communications.
Security experts emphasize that Apple will never send virus alerts or phishing messages through the Calendar app. The alerts frequently include links or phone numbers aimed at harvesting personal information or payment details, putting users at significant risk of identity theft and financial loss.
Steps to Remove Malicious Calendar Subscriptions
Getting rid of these spam calendar alerts involves a few straightforward steps. In many cases, the alerts originate from an unwanted calendar subscription. To check for this, navigate to Settings > Apps > Calendar > Calendar Accounts > Subscribed Calendars. If you identify a subscription you do not recognize, delete it immediately to halt the alerts.
Alternatively, users can remove unwanted subscriptions directly from the Calendar app. Open Calendar, tap the calendar icon at the bottom, locate the questionable subscription, tap the information ('i') icon, and mark it as junk when prompted. Some Apple users have shared an additional method on support forums: open the suspicious event, copy the sender's email address, paste it into the Mail app, then block that sender and delete the message.
User Experiences and Expert Advice
Several users on Reddit's r/Apple forum have reported similar experiences, with one commenter noting, 'Rule of thumb is common sense. If they're using calendar events to communicate with you, they certainly did not hack into your device.' Another user advised, 'You need to go into your Calendar subscriptions and remove any that you do not recognize as having subscribed to and then be more careful in opening emails going forward.' Suggestions include setting all calendar invites to require manual approval instead of automatic addition from scanned emails.
One user highlighted a flaw, stating, 'Even if the spam invite went to your junk mail, it still shows up on your calendar. You have to go find it and delete it from your junk, which is a hassle. Apple needs to fix this.'
Future Threats and Prevention
Researchers warn that similar notification-based scams are likely to increase as attackers seek new ways to bypass app-store security controls. To protect yourself, avoid interacting with suspicious notifications, refrain from clicking on unknown calendar invites, and regularly review your calendar settings. Vigilance and prompt action are crucial in mitigating this evolving cybersecurity threat.
