Phishing Has Moved Beyond Suspicious Links: Calendar Invites, QR Codes, and Attached Emails

A message does not need an obvious misspelling or a strange link to deserve a second look. It may arrive as a calendar invitation, place its destination behind a QR code, or ask you to open another email attached to the first one.

Microsoft’s Q2 2026 email threat report, published July 23, describes campaigns combining nested EML attachments, calendar invitations, and a Microsoft authentication redirect. The practical lesson is to assess the request across the entire interaction, even when individual steps look familiar.

A calendar invitation is still a message from someone

A calendar item can feel more official than an email because it appears beside meetings you actually arranged. Treat an unexpected invitation as unverified content. A title resembling an invoice, security notice, or subscription renewal does not establish who sent it.

For example, an invitation claiming that a subscription renews today might include a phone number to “cancel.” Instead of calling the number supplied in the invitation, open the service through its usual app or your saved bookmark and check the account there.

Use the invitation’s report or spam controls when appropriate. Avoid replying merely to ask whether an obviously unsolicited demand is real. If it refers to a meeting you expected, confirm with the organizer through an existing contact route.

A QR code changes the route, not the trust decision

Scanning a code often moves the interaction from your computer to your phone. That switch can make it easier to lose track of the original sender and request. A code labeled “secure document” is still just a route to a destination.

If a work message asks you to scan a QR code to sign in, open the work service directly instead. For an expected code, inspect the destination shown by your scanner before visiting it. Do not enter credentials solely because the page has familiar branding.

An attached email can carry another layer of persuasion

An .eml file is a standard email file, useful for forwarding a message intact or keeping an archive. The extension does not make its contents trustworthy. An attached message can contain links, files, and claims just like the message that delivered it.

A fabricated conversation inside an attachment may suggest that colleagues have already approved a payment or document. Check that claim with the actual colleague using a known address or phone number. Avoid continuing through a chain of attachments simply because each one promises that the next contains the document.

Check the action the message wants you to take

Before signing in, sharing a code, opening a file, or sending money, pause on four questions:

• Was I expecting this? Connect the request to a real task or conversation.
• Can I verify it independently? Use an existing contact or open the service directly.
• Does the destination fit the task? Familiar page design is not proof of ownership.
• Why is there urgency? A deadline that discourages checking deserves scrutiny.

For changes to payment details, verify through a previously established channel. Calling a number included in the same suspicious message does not provide independent confirmation.

If you already interacted

If you entered work credentials, approved an unexpected sign-in, or opened a suspicious file, contact your organization’s security team promptly. Explain what happened and preserve the original message for their investigation. For a personal account, use the provider’s official recovery and security pages, reached directly, to review access.

If money was sent, contact the bank or payment provider immediately through its official channel. Keep the message and transaction details. Fast reporting gives the people handling the incident more opportunity to act.

What an archive can and cannot do

A saved original can help you reconstruct the sender, timing, and instructions later. MailVault stores archived mail as standard .eml files, keeping the message available for review. This is a record-keeping benefit, not a guarantee that a message is safe.

Apply the same checks to archived mail as to a live inbox. A local copy can preserve a malicious link just as faithfully as a legitimate receipt. Keep the record, verify the request, and use your provider’s or organization’s reporting process when something looks wrong.

Written October 1, 2026. Provider features and availability may change; check the linked official guidance before changing your setup.