For some Apple Calendar users, the side effects of Thanksgiving and Cyber Monday included more than just a stomachache and a lighter wallet: spam invitations promising great shopping deals are littering their calendar apps in iOS and macOS.
The problem stems from a default iCloud setting, which allows people to send invitations directly to the Apple calendar app, bypassing your email inbox. If you decline an invitation, the sender is automatically notified. That might not be a concern for invites from friends or colleagues. But if you delete a spam invite, the spammer will know that your email address is valid and be encouraged to send more spam.
The beginning of this year's holiday shopping season seems to have brought a marked increase in spam invites. An editor at PCMag.com and multiple Twitter users report receiving calendar invitations notifying them of sales, including for major brands like Michael Kors and Ray-Ban.
Turning off invite notifications in Apple's Calendar apps is easy enough, as Ars Technica notes. Log in to your iCloud account using a Web browser and open the calendar Web app. Click on the gear icon in the lower left corner, then click Preferences > Advanced. There, you'll be offered the option to receive invites via email or app notification. Once invites are routed through your email, you can delete the ones you don't recognize without responding to the sender.
If the Advanced setting does not show up, you might not have Calendar enabled for iCloud (check it via Settings > iCloud > Calendars on your iOS device).
Sending all invitations through your email has the additional advantage of forcing them to meet spam filters and virus scanners, but it's a blunt solution that could prove inconvenient if you've grown accustomed to the app notifications for calendar invites.
Besides spam, security experts say there are potentially far more troublesome aspects of unsolicited calendar invites, including viruses and identity theft. Invites that go unscanned by spam filters could contain links that install malware on a user's computer—yes, even Macs and iPhones are vulnerable to viruses.
"If a cybercriminal has gained access to a large database of email addresses, then understanding which are real and being used allows them to target the victim with more specific attacks," Tony Anscombe, senior security evangelist at antirvirus software maker AVG Technologies, told PCMag in an email. "If they have data, including encrypted passwords, it could validate which ones to attempt to decrypt, reducing the effort required."
Since Apple Calendar also has a Web interface and is compatible with calendars from multiple sources, including Google Calendar, users on Windows machines could also find themselves inadvertently clicking on malicious links from spam invitations. Malwarebytes CEO Marcin Kleczynski told PCMag that he has seen similar issues crop up on Windows machines.
"I started seeing random emails with calendar invites that were directly injected into my calendar," he wrote in an email. "This is not a Mac-only issue."
Apple did not immediately respond to a request for comment on whether it has received recent reports of increased calendar spam, or whether it plans to implement spam detection specifically for the Calendar app.
Editor's Note: This story was updated at Nov. 30 with comment from security experts.