Threat actors have discovered a new vector of attack to utilize during phishing campaigns. Calendly, a free scheduling assistant, allows threat actors to use email to invite the victim to a meeting with the title and link they choose. This increases the legitimacy of the phishing email as it appears to come from a legitimate company. INKY, an email monitoring company, found specific instances where the phishing actors titled the meeting “You have received a new fax documents” with an embedded link to “preview” the document. The link instead brought victims to a Microsoft Word phishing page where they were required to sign in to access the document. The page also included a common tactic in newer phishing campaigns to ensure credentials are free of typos, in which the user is prompted to enter their credentials twice, due to the credentials being “invalid.” The victim is then sent to the domain of their email address to minimize the likelihood of realizing the compromise and reporting it as phishing. While most of the techniques employed in this campaign are standard, the use of Calendly has not been previously identified. CTIX analysts recommend security teams look out for and alert their users to the use of legitimate service entities such as Calendly in phishing schemes, and remind users to employ basic security protocols. Another red flag would be prompting a user for credentials to copy and send back to their command-and-control (C2) infrastructure. The use of a password manager is a simple method to avoid entering credentials into malicious phishing websites, due to the phishing domain not being the same as the impersonated website’s. A password manager will not autofill the password, tipping users off that the website they’re on is not legitimate.