Hackers Find Office Workers Will Surrender Any Password To Avoid Missing A Meeting
Specialists warn that corporate employees will happily type bank details into suspicious portals rather than risk arriving late to an empty alignment call.
LONDON, cybersecurity analysts have confirmed that calendar phishing scams took off after criminals noticed a basic fact about office life: employees would rather surrender their banking details than risk missing an arbitrary meeting. Security agencies spent years preparing for state-backed algorithmic warfare. Criminal syndicates now send a vague fourteen-minute appointment, and people comply before the kettle has boiled.
The scam relies on an office worker’s fear that colleagues are gathered in a virtual room, discussing quarterly deliverables without them. An alert appears for an unannounced touchpoint called “Urgent Resourcing Review”. Basic digital caution ends there. Employees click through false verification screens and hand over their credentials for the chance to join an empty video call.
“For over a decade we wasted enormous resources writing complex decryption software and infiltrating corporate firewalls,” said Keith Vole, chief operations architect at the International Syndicate of Phishing Artisans. “Now we send an invitation called ‘Project Milestone Catch-Up’ for eight on a Tuesday morning. The victim enters their home address, passport number and childhood fears within forty seconds, because they don’t want to be late for a slide deck.”
“The victim will enter their passport number just to avoid being late to a slide deck.”
That works because phantom meetings are already almost identical to normal business. A corporate calendar commonly holds dozens of unexplained appointments, many overlapping, placed there by automated systems, former managers and colleagues nobody recalls meeting. So a warning that an account-renewal session starts in four minutes feels much like any other Wednesday afternoon.
Investigators have found staff who gave their credentials to fraudulent portals and then sat in dark conference rooms for twenty minutes, waiting for the scammer to log on and share a screen. “I assumed the syndicate was having audio difficulties,” said Pamela Finch, a senior logistics coordinator who entered her company card details to unlock an invitation called “Synergy Alignment Check”. “After ten minutes, I asked in the chat whether anyone had dial-in details.”
The training has gone badly. In pilot defence workshops, employees told to delete unfamiliar calendar entries became distressed at the thought that an unsolicited invite from an anonymous address might affect their performance appraisal. Several managers said they would accept an invitation demanding ransom anyway, in case somebody was taking attendance.
Experts say the technique has moved into recurring series and tentative invites, which threatens what remains of the working week. Advisories tell staff to treat sudden calendar invitations with suspicion. Most will keep clicking every link until somebody schedules a forty-five-minute retrospective about the problem.