The calendar within iCloud appears to be a new target for cybercriminals carrying out phishing campaigns. Researchers have reported that invitations from Apple’s calendar are being misused to send fraudulent emails posing as payment notifications.
This is according to BleepingComputer, which received reports from victims. The scammers send an invitation that looks like a normal calendar notification, but the notes contain a message that purports to be from PayPal. It claims that an amount of $599 has been charged and that the recipient must call a specified phone number to correct this. Anyone who calls is put through to a supposed employee who tries to convince the caller that their account has been hacked or that software needs to be installed to enable a refund. In reality, this is an attempt to gain access to the victim’s computer or bank details.
What makes this attack unique is that the emails do not originate from obscure servers. They are sent directly through Apple’s infrastructure. The sender address noreply@email.apple.com  easily passes the usual security checks such as SPF, DMARC, and DKIM. This makes the invitation appear legitimate and increases the likelihood that spam filters will allow the message through.
Messages difficult to block
According to BleepingComputer’s analysis, a Microsoft 365 address is used as a conduit. This address is likely part of a mailing list that automatically forwards the invitations to multiple recipients. Microsoft then rewrites the return addresses using the Sender Rewriting Scheme. This allows the messages to pass through the authentication checks. As a result, the fraudulent messages not only appear credible, but are also technically difficult to block.
Although the phishing concept itself is not new, the combination of Apple’s legitimate calendar invitations and Microsoft’s forwarding mechanism creates a credible façade. Cybercriminals are once again demonstrating their ability to find creative ways to exploit existing features of large technology companies for fraud. According to BleepingComputer, Apple has not responded to questions about this abuse.