Phishing with Calendars (.ICS Files)
Last updated
Was this helpful?
Last updated
Was this helpful?
We can leverage calendar invites as an initial access vector, using the (ICS) file format to create a phishing scenario.
The ICS File format is used on several Calendars like Google Calendar, Outlook, and Apple Calendar.
The easiest way to get a .ics file is by creating a Google Calendar invite from one Gmail account to another and then downloading the invite.ics email attachment.
An example of an Exchange .ICS file can be found below:
Interesting fields can be found below
UID
UID Should be uniq and regenerated each times
ORGANIZER
The organizer can be spoofed by modifying the CN= value
ATTENDEE
You can add as many attendee as you’d like
PARTSTAT
We can force Attendees To Accept The Invite by setting PARTSTAT=ACCEPTED
DTSTART / DTEND
This properties specify the start and end times of the event
DESCRIPTION
It provides additional details about the event, and can be used to insert malicious contents / links.
can be used to automate the process of creating .ICS phishing files. These invites can include a phishing URL, inside the DESCRIPTION field, crafted with a convincing pretext, encouraging the target to download a file or enter their credentials.
