The Fake McAfee Renewal Typed Into a Calendar Field

One mailbox at a North American industrial automation manufacturer received a Google Calendar invitation. The event title was "Event 3039", a placeholder with a number in it, and the slot was one hour on a weekday morning in a Central time zone.

The description field underneath it was the attack. It read as a McAfee subscription renewal confirmation: a "Five Years Coverage" plan, Subscription ID 832518413, a total of $541.29, a placeholder copyright footer, a note not to reply to the message, and one phone number to call.

There was no link to attacker infrastructure. The RSVP buttons and the view-event link were genuine, unmodified calendar[.]google[.]com endpoints. And the authentication summary came back clean on every line: SPF pass, DKIM pass twice, DMARC pass, composite authentication pass.

The Pitch Lived in a Structured Data Field

The operator never composed an email. They created a calendar event, typed the renewal copy into the event's description field, set the target as an attendee, and stopped. Everything after that belonged to Google. The calendar notification service authored the message, rendered the description verbatim into the visible body ahead of the standard invitation layout, generated the per-attendee RSVP actions, and delivered the result.

That is a different shape from a lure in a link or an attachment. The payload rides inside a legitimate structured field that is doing exactly what it was designed to do: carry arbitrary text from an organizer to an attendee, faithfully displayed. There is no malformed content, no injection, and no parser abuse to report. The scam copy arrived formatted like every real invitation that mailbox had ever received, because the same pipeline produced all of them.

For an inspection stack built around URLs and file hashes, that leaves very little to grab. The attached calendar file hashes clean, because calendar files are not malicious. The links resolve to Google. The fraud exists only in the words, and the words sit in a field many pipelines treat as event metadata rather than as body content.

Nothing in the Header Was Wrong

This is where the case separates itself from the usual calendar-invite teardown. In the common version of this technique, the strongest passing signature belongs to the provider while the organizer domain gives itself away, hard-failing SPF or publishing no DMARC policy at all. There is a split identity to find, and finding it is the detection.

Here there was no split. SPF passed. Two DKIM signatures passed, one for google[.]com, since Google genuinely sent the mail, and a second derived from the organizer's own Google Workspace domain. DMARC passed with alignment intact. Composite authentication passed.

The reason is the sender. The invitation came from a compromised mailbox at a South Asian academic institution, an established tenant with a published SPF record, working DKIM signing, and an enforced DMARC policy. That institution is a bystander here, not a participant, which is why its domain is withheld. Whether the account was taken over or otherwise abused to issue invitations, the sending identity was real.

Alignment as defined in RFC 7489 answers one narrow question: did a domain authorize this message. Two domains did, honestly. Every cryptographic and reputational signal a gateway can measure returned a pass, and none of them were wrong. They simply were not answering the question that mattered.

A Product McAfee Does Not Sell

The brand in the body copy is real. The product is not. McAfee does not sell a subscription line called "VirusSecure", and that mismatch is the cheapest tell in the whole message. Brand-name matching passes on the word McAfee. Nobody checks the product name against a catalog.

The quality tells stack up from there. The greeting rendered as "Hello ," with nothing after it, a merge field that resolved to empty. The instruction block reads "Don't reply to then email." The signature closes with a fabricated support agent name under a help desk McAfee does not operate. And a five-year antivirus term at $541.29 is not a plan anyone recognizes, which is the point of an unfamiliar number: large enough to alarm, specific enough to look like a real line item.

The Only Attacker-Controlled Asset Was Ten Digits

Strip the calendar mechanics and this is a callback scam. There is no credential page, no macro, no redirect chain, and no lookalike domain, because the entire monetization path is a phone call. MITRE ATT&CK tracks it as spearphishing voice, and defenders know it as callback phishing or vishing. The fraud happens live on the line, where an operator handles objections and walks the caller toward remote access, a card capture framed as cancelling the charge, or a refund flow run through the victim's own banking session.

The 2024 Verizon Data Breach Investigations Report puts a human element in 68 percent of breaches. A message with no payload reduces the attack surface to that element and nothing else.

See Your Risk: Calculate how many threats your SEG is missing

One structural note. Depending on tenant settings, an invitation can also write itself onto the recipient's calendar with a reminder attached, and deleting the email does not necessarily delete the event.

What Scored It Without a Payload

With no artifact to analyze, the evaluable material was identity and behavior. Themis, the IRONSCALES Adaptive AI analyst, weighed a first-time organizer against a placeholder event title, a two-word personal alias in the display name, a consumer security brand asserted in the body with no matching sender domain, a multi-year charge nobody had authorized, and a single phone number as the only available action. It returned 75 percent confidence and labelled the message credential theft.

The label is worth naming rather than smoothing over. The only action in this message is a phone call, so credential theft is not the tidiest category for it. The score, not the category, carried the decision, and the case reached the SOC through a report from one of the 35,000+ security professionals across 17,000+ organizations in the IRONSCALES community. On a payload-free case, that pairing is what a working control looks like.

Where the Control Has to Sit

Three moves come out of this case. Treat invitations as mail, and inspect the event description with the same rules you apply to a message body, since that is where the pitch lives. Stop reading a clean authentication result as a verdict, because a compromised legitimate tenant produces perfect authentication by definition, which is the argument for augmenting Google Workspace rather than assuming provider notifications police themselves. And check asserted product names, not just brand names.

Then give people one rule for unsolicited billing notices, whether they arrive as mail or as an event on the calendar, consistent with CISA phishing guidance and the behavior NIST describes: never dial the number in the message. Look the vendor up independently, then report it. A callback lure only pays if somebody calls.

Indicators of Compromise

MITRE ATT&CK Mapping

See You Next Time

The strongest thing about this message was that nothing about it was wrong. Every signature checked out, every link went where it said, and the fraud was a text box. Check back tomorrow.