Date: 01/12/2026
Severity: Medium
Summary
These scam messages falsely claim a charge for a product or subscription. They include a support number for recipients to call about the charge. Scammers wait for victims to call and attempt to cancel the fake billing. The operators then request credit card or other sensitive information. Recently, these scams have increasingly used calendar invites. They appear across platforms, as .ics files can be imported into any calendar app.
Indicators of Compromise (IOC) List
Hash : | 693c8b753ab926327ee17f35876296c0ae7a7ec6bfeb1254bcf21e84cfbe8659
72d1dde2016a7fcbd69f73de3e29b5d8988e1c3ae00e92080ec5db011db9f4a1
9f6ed37ca59d1a1dde397b7453600b52885a203b1e6a7f36f1cde27993fa84f4
|
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | sha256hash IN ("693c8b753ab926327ee17f35876296c0ae7a7ec6bfeb1254bcf21e84cfbe8659","72d1dde2016a7fcbd69f73de3e29b5d8988e1c3ae00e92080ec5db011db9f4a1","9f6ed37ca59d1a1dde397b7453600b52885a203b1e6a7f36f1cde27993fa84f4")
|
Reference:
https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-01-07-scams-using-calendar-invites.txt