‘You Have a Meeting’: The Calendar Phishing Scam Growing Exponentially
Welcome to the 143rd edition of HX Weekly. Let’s get back to basics and talk about phishing. It is the quintessential cyber threat that everyone should be intimately familiar with by now. It’s everywhere, and when coupled with sophisticated social engineering, it can be shockingly convincing.
Take the latest vector sweeping inboxes: calendar invitations. A simple notification reading “You have a meeting” drops into your calendar, luring you in with familiarity before landing a malicious payload.
What now? Stay vigilant and think twice before clicking anything unexpected.
Tools: Always practice reverse verification. Even if a message appears to come from someone you know well, if you weren’t expecting it, take a moment to verify with the sender through an alternate channel before interacting.
The Threat Horizon: Calendar Lures, Self-Replicating Models, and Zero-Clicks
This week’s security highlights demonstrate why ignoring basic cyber hygiene carries a staggering price:
- Self-Replicating AI Warnings: Anthropic has issued a stark warning that small AI models could soon begin self-replicating on IoT devices, pushing autonomous risk into everyday hardware.
- Zero-Click Ad Spyware: Citizen Lab traced sophisticated, zero-click Candiru spyware infections targeting Al Jazeera journalists directly through online ads, while researchers warn that zero-click spyware is increasingly infecting devices via standard web advertisements.
- Malvertising & Search Hijacks: Hackers are actively abusing Google Ads and Bing search redirects to push deceptive Claude ClickFix attacks.
- Massive Breaches & Patch Crises: A staggering data breach in Denmark exposed 8.8 million people—linked directly to the timelessly terrible password
"123456". Meanwhile, Microsoft dropped an actively exploited zero-day amid a record-breaking patch batch of 1,413 vulnerabilities, prompting a startling statistic: one-fifth of CISOs are taking time off on Patch Tuesday just to escape the overwhelm. - Enterprise Scrambles & Fed Raids: Bank of America reportedly had to bring in 1,000 external contractors just to patch all the bugs identified by Mythos. On the law enforcement front, the FBI raided North Korean (DPRK) IT worker laptop farms in Texas, arresting several US nationals, while West Asian scam compounds were raided, rescuing over 100 suspected trafficking victims.
- FTC Crackdowns: The FTC revealed that commercial “sextortion” protection companies have been actively deceiving customers about the true nature of their services.
What Now? Back to the Fundamentals
The cybersecurity fundamentals are like that one friend who never leaves the party—always reliable, always important. This week’s massive breaches and phishing campaigns were brought to you by folks who chose to ghost the basics (such as using "123456" as a password—because who needs security when you have convenience, right?).
- Embrace Zero Trust: Watch our featured PSA this week, “How to practice zero trust?” (inspired by Broadchurch), to learn how to verify every single digital interaction.
- Protect Your Hardware: Android is rolling out new AI-driven defenses against messaging scams and fake calls, but your best defense remains healthy skepticism.
- Ground Your Mind: Amidst the digital chaos, remember to center yourself. Watch our wide-format More You digital detox PSA, “Centering: Reset Your Mind and Guard Your Security” (inspired by Of Mice and Men), to clear your head.
Inside Hexagon: HX Reports and the 31st T3 Edition
Even though we still face operational limitations, rest assured our team is doing everything possible to keep the work moving forward. We are thrilled to announce a brand-new campaign from our team at HexagonPSA: HX Reports, launching soon at a platform near you!
Also, make sure to check out the latest T3 (31st Edition): What is a zero-day vulnerability? (inspired by 21 Jump Street).
Stay vigilant, keep your passwords complex, and subscribe to HX Weekly at hexagoncenter.org
. Drop your guesses for our PSA and T3 themes in the comments!
Warmly,
— The Hexagon Center Team
