Silent Threat: How Malicious Calendars & ‘Promptware’ Target 4M+ Devices Daily

A recent investigation by Bitsight TRACE has revealed a new attack vector involving malicious calendar subscriptions that target over 4 million iOS and macOS devices daily. Unlike traditional email phishing, these attacks exploit users' trust in system notifications. When users subscribe to a calendar, their devices sync with the hosting domain, allowing attackers to push spam and phishing links without further interaction.

The research identified 390 malicious domains, highlighting the risk of 'Promptware,' where attackers can embed harmful prompts in calendar events that could manipulate AI assistants into executing unauthorized actions. Users often remain unaware of their subscriptions, making this threat particularly insidious.