iCloud Calendar infrastructure abused in PayPal phishing campaign

iCloud Calendar invites are being abused to mount PayPal phishing campaigns, with attackers leveraging legitimate calendar infrastructure rather than PayPal itself. According to BleepingComputer, the technique uses an iCloud Calendar event created by phishers, sending an invitation from Apple’s servers with a noreply@email.apple[.]com address to forgery‑proof recipients, while the recipient sees a Microsoft 365 account as the apparent sender.

The campaign employs the Microsoft Sender Rewriting Scheme to forward emails without tripping protections, so the “From” address remains the original sender even though it appears to originate from Apple. The phishing text is often stored in the event’s Notes field, and the call‑back style aims to prompt targets to phone a listed number and download malware.

The example invitation in the article shows a charge of USD 599.00 dated 28 August 2025 for “Purchase Invoice.” To stay safe, users should verify PayPal messages directly on PayPal[.]com, not rely on emails from calendar invites, and enable 2FA on their PayPal accounts, while reporting suspicious messages to phishing@paypal[.]com.