Urgent Alert: 1.8B iPhone Users Warned About Calendar Hijacking Scam
New Scam Targets iPhone and iPad Users via Fake Calendar Invites
Cybersecurity researchers have issued a warning to iPhone and iPad users about a new scam that exploits their calendar invites. This scheme is designed to flood victims’ calendars with fake alerts, aiming to scare or manipulate them into revealing personal information such as passwords and banking details.
Unlike traditional malware, this scam does not require users to install an app or download software. Instead, the attack is triggered when users accidentally click on a malicious link online. The fake alerts can appear as urgent security warnings, prize notifications, or even fake system messages. Because these calendar subscriptions bypass the App Store, they often seem official and are difficult to stop.
Experts have noted that this tactic is spreading rapidly and is targeting both iPhone and iPad users. Apple users are advised not to interact with suspicious notifications, avoid clicking on calendar invites, and review their calendar settings immediately.
In many cases, the scam works by tricking users into subscribing to a hidden calendar through deceptive pop-ups. Once subscribed, scammers can push unlimited notifications directly to the device. These alerts often include links or phone numbers intended to harvest personal information or payment details.
Security experts emphasize that Apple will never send virus alerts or phishing messages through the Calendar app. Removing these spam calendar alerts typically involves a few steps, but the process is usually straightforward.
In many instances, the alerts originate from an unwanted calendar subscription. To check for this, users can go to Settings > Apps > Calendar > Calendar Accounts > Subscribed Calendars. If there is a subscription that is not recognized, it should be deleted to stop the alerts.
Some Apple users have shared alternative methods on Apple’s support forums. One approach involves opening the suspicious event, copying the sender’s email address, pasting it into the Mail app, then blocking that sender and deleting the message. Another method is to remove unwanted subscriptions directly from the Calendar app.
To do this, open the Calendar app, tap the calendar icon at the bottom, find the questionable subscription, tap the information (‘i’) icon, and mark it as junk when prompted.
Researchers have warned that similar notification-based scams are likely to increase as attackers seek new ways to bypass app-store security controls. Several users on Reddit’s r/Apple forum reported similar experiences in response to a post asking if they had been hacked.
One commenter wrote, “Rule of thumb is common sense. If they’re using calendar events to communicate with you, they certainly did not hack into your device.”
Another user added, “You need to go into your Calendar subscriptions and remove any that you do not recognize as having subscribed to and then be more careful in opening emails going forward.”
“Perhaps set all Calendar invites to have to be manually approved instead of automatically being added from scanned emails,” suggested another user.
“Even if the spam invite went to your junk mail, it still shows up on your calendar,” one user pointed out. “You have to go find it and delete it from your junk, which is a hassle. Apple needs to fix this.”
