Prevent Calendar Injections

Calendar Injection (also known as Calendar Spam) is a tactic where attackers bypass traditional email spam filters by placing malicious or unwanted events directly onto a user's calendar.

How to Stop It (User Level)

You need to change two specific settings in the user's Google Calendar to prevent this from happening again.

Step 1: Stop Auto-Adding Invites

1. Open Google Calendar on a desktop.

2. Click the Gear Icon (Settings) > Settings.

3. On the left sidebar, click Event settings.

4. Find the dropdown for "Add invitations to my calendar."

5. Change this setting to: "When I respond to the invitation in email."

   • Note: You can also choose "Only if the sender is known," but the option above is the safest lock-down method.

Step 2: Stop Events from Gmail

1. In the same Settings menu, look for Events from Gmail.

2. Uncheck the box that says "Show events from Gmail"

3. It will warn you that you will no longer see auto-generated events (like flight confirmations). Confirm by clicking OK.