Sponsored: Sublime Security on the rise of ISC calendar phishing

0:05Catalin Cimpanu: Hello, this is Catalin Cimpanu and this is a Risky Business Sponsor interview with Luke Wescott, Threat Detection Engineer at Sublime Security. Welcome, Luke. Catalin, thank you so much for having me. It's great to be here. I was looking at one of Sublime's reports today where your team was pointing out that phishing campaigns leveraging calendar invites have been increasing in volume. These are campaigns where you get an invite to a scheduled meeting in an online calendar, but you're asked to authenticate first on a phishing page or download some malware-less installer. This stuff has been doubling or tripling in volume from month to month this year, but since August, you say it's now expanding at a 1 ,500, 3 ,000 % rate.

0:48Catalin Cimpanu: What's going on here? Do you have any theory on why this is happening? Yeah, I think the virality of it is particularly interesting. One of the things that I think is really attributing to this massive exponential growth, I think, is the advent of LLMs. So we think of a lot of the phishing world in email is kind of similar in calendar phishing as well, where the ability to use an LLM system to generate very similar but slightly different content has been increasing tremendously. and the ability for an attacker to, let's say, send out thousands of emails that are each just slightly different from each other carries over into the calendar world.

1:36So it's become incredibly easy for an attacker to create unique content to send out to people. But I also think part of the reason that this is viral is kind of a similar reason why things go viral online because it worked. This vector has been around for a while. But I think with the recent success that certain threat actors are having, everyone else is sort of jumping on to this trend and trying to take advantage of this. While it kind of seems like the calendar providers between Google and Outlook and all the calendar providers really are sort of behind the ball on this and scrambling to catch up.

2:14Catalin Cimpanu: I actually had a question about this. In cyber defense, you have some attacks that can be easily stopped. calendar phishing seems something that regular users can typically spot but an automated system can easily detect obviously as long as you have an email security product besides llm is there some other kind of innovation here that makes calendar phishing extremely successful or is just or is this just as you said a vector that's successful because it's not properly defended in the wild It's a good question. Like when I put together this question, I was thinking about ClickFix. Is this just really something really innovative or is it just something that people are not ready to defend against?

3:04Thanks, Catalan. I think that's a really good question to ask. And I think really it's sort of like a two-part answer. I think first and foremost, yeah, I think a lot of enterprise users are going to find that their security solution is going to be pretty quick to pick this kind of stuff up. But I think the other part of it is really like the user isn't anticipating seeing malicious content in this space. It's a really unfamiliar territory to start seeing malicious content popping up. And I think that's what's really appetizing to threat actors is that when you open your calendar, you see your one-on-one with your boss, you see your dentist appointment, and then you see a callback scam urging you to call a phone number and make a payment on something that might sort of appeal to something that you are slightly familiar with or just kind of really prying on the user's sense of urgency and trying to catch them off guard.

4:01But I think having something malicious appearing in an unfamiliar location is really what's going to lead to a lot of success in this area.

4:10Catalin Cimpanu: Basically, a little bit like ClickFix. You just don't expect it there. Yeah, exactly. Yeah, that's a really astute thing to kind of tie in there. Exactly right. So what do you use for detection? The ICS invite file itself or are there other signals for this? Yeah, it's a little combination of both. So we are looking specifically at the ICS file. There are some malicious indicators within the structure of the event itself that we can look at. But then also the package that it's delivered in matters a lot to us too from Sublime side of things. Not every calendar is going to come with an email attachment as well.

4:50So it's important for us to be able to identify both. But when we can identify the email or the package that the ICS is delivered in, that can be important to us as well.

5:04Catalin Cimpanu: Are these campaigns targeting Google Calendar specifically? I imagine they would, right? Or is there more? Yeah, we see Google Calendar targeted pretty specifically, but we are also seeing this in Outlook and in other enterprise calendar environments. And in your first answer, you mentioned that threat actors are likely using LLMs. I presume you're using LLMs too. How would that look like on the defensive side? How would a defensive anti-ICS phishing LLM be trained? That's a really good question. One bit of advice that I would give to someone who's training an LLM for detecting malicious calendar invites is to be especially careful with the advent of stuff like prompt injection.

5:54I think we're going to start to see that area be very focused from threat actors specifically. When agents are taking actions on people's calendars for them, that's going to be a pretty interesting place for attackers. They're going to be focused very heavily on that area, trying to get LLMs to do things that they shouldn't be doing with people's calendar invites. And so that would probably be like the most important thing that I would have someone focus on if they were making an LLM on the defensive side is to be aware of being coerced.

6:26Catalin Cimpanu: You haven't seen this type of behavior for now, right? Good question, Catalan. We have not seen attempts in the wild, specifically within calendar invites, but we have seen research and we've been doing our own research in anticipation of that vector being abused. Besides calendar phishing, I remember this year several other phishing trends emerging like device code phishing. I specifically remember that device code phishing exploded when some phishing kits were adapted to automate the process. Are you seeing, I don't know how deep you can go in the threat intel side beside the user inbox, but are you seeing signs that there might be a phishing kit specifically designed for calendar phishing besides the llm use that let's say automate these messages somehow but are we seeing specific phishing kits yeah super good question kylan yeah and i think i will leave it to our threat team to sort of divulge more of the specifics around naming these but we have totally seen indications that sort of like some of the structure is is definitely being reused from campaign to campaign or across like different attempts.

7:44We've certainly seen some indicators that there are phishing kits for ICS out there.

7:52Catalin Cimpanu: You also mentioned earlier something about the calendar vendors. Do you think they can do something about this or is this just a guns don't kill people argument where the tool is just abused by bad people? That's a good, That's a really good question, Catalan. I think in the enterprise world, I do trust that security tools are going to be pretty quick to pick this up as a vector and get protection out. For everyday users, like for my calendar, my personal calendar, for your calendar, for your personal calendar, I really do hope that the companies that allow personal people just to manage their accounts get on top of this.

8:37And I think it'll be similar to how, let's just use Google as an example. I think it'll be similar to how Google treats spam, which is their spam has gotten pretty good at filtering spam out over the years, but it took some time. And I expect we'll kind of see the same thing for calendar invites over the coming years is that it will take a little bit of time, but I do expect that these companies will jump on this for like the individual user layer too.

9:02Catalin Cimpanu: You mentioned regular users. Sublime is an enterprise product, but do you know if these campaigns are also targeting regular users, not just those in corporate environments that are typically accustomed to receiving calendar invites? Yeah, I've certainly seen individual users being hit by this outside of enterprise. So I think for the average, you know, everyday person, it is something that you definitely want to be keeping an eye out for. If we want to, let's say, warn users about this. What are the most common lures and forms sublime has seen in the wild that everyone should be aware of? Like what's the type of invites threat actors typically use?

9:46So there are usually, you know, two distinct types of lures that we see in the wild. And the first one is pretty familiar tactic, which your listeners might be familiar with, which is callback phishing or callback scams. And this will be when the invitation itself, instead of being called, you know, Luke's one-on-one with Catalan, it will instead say, hey, Luke, we noticed a charge for$600 on your Amex card. Please call this phone number to get this issue resolved. That will be the full name of the calendar invite itself. The other one is fairly similar, again, to a different vector that you've heard, which will be like a phishing link or a password stealing attempt.

10:31And what that will be is a fairly suspicious link or named invitation as well. The invite might be named, hey, warning, your password is going to expire in 24 hours. And then within the calendar invite itself, it will contain a link that when clicked on, it will attempt to harvest your credentials. Those are the two biggest ones that we're seeing in the wild.

10:53Catalin Cimpanu: The first method you mentioned, I kind of realized, wouldn't someone like Shiny Hunters be interested in using this to target specific clients? I imagine this would be extremely effective form of social engineering. Yeah, absolutely. I think, you know, threat actors writ large are certainly going to be interested in, and we might see more adoption from some of these bigger players as time goes on, just because of, to your point, right? Like how much social engineering is going to be able to be pulled on this and how much trust most users just have in their calendars, right? A lot of these invites show up automatically in your Google calendar, for example.

11:36And so there's a lot of like bypassing that just happens by the nature of the way calendar invites work that will be interesting for sure for most threat actors.

11:46Catalin Cimpanu: Look, that was a very interesting conversation. Thank you for your time today. Thank you so much for having me, Callan. Great talking with you.