This Scam Comes With Homework - Google Calendar

Homework from a stranger

You open your calendar and find a meeting that needs some paperwork first. Annoying, but familiar. Who remembers every appointment?

Now the question has quietly changed from “Who invited me?” to “What do I need to bring?” That is a lot of responsibility to give a square on a calendar.

Sublime's example used a supposed billing document to lead to a remote-access installer. The tool, ScreenConnect, has legitimate uses. The attacker's configuration and deceptive delivery were the problem.

Receiving the invitation alone does not infect your computer. The illustrated attack still needs someone to follow the link and install the software.

On the schedule does not mean approved

Imagine a stranger writes a meeting into the front-desk planner. Nobody agreed to it, but now someone is gathering documents for it. This is Connor's analogy, not a second reported incident.

The connection to choice architecture is about how presentation shapes a decision. An automatically added event can look like an established task rather than an unverified request.

In a 2006 experiment, 70 students considered a hypothetical retirement plan. Making enrollment the default changed what they inferred HR recommended: 31 of 35 thought HR favored enrollment, compared with 2 of 35 when enrollment was not the default. Those are judgments about a recommendation, not actual sign-ups.

The study did not test calendar phishing. It helps explain the distinction between something being placed in front of us and someone actually endorsing it.

Give invitations a waiting room

On a computer, open Google Calendar yourself:

1. Open Settings, then Event settings.
2. Find Add invitations to my calendar.
3. Choose When I respond to the invitation in email.

The result: new events are added after you respond to the invitation email. The limit: old entries remain, and the email still needs checking. Work or school administrators may restrict the options available.

Before downloading meeting “homework,” contact the supposed sender through a channel you already trust. Do not use a number supplied by the suspicious invite to verify that same invite.

Your calendar can remember appointments. It cannot vouch for the person making them.

What is established, and what is not?

Sublime reported growth in its own observations, not a completed count of every calendar attack. Its example was detected and remediated. A successful infection total was not supplied, and this does not show that Google's systems were breached.

This page is an article adaptation of Connor's September 19 video, not a verbatim transcript. Sources were checked September 26, 2026.