Another meeting invitation. This one wants your Microsoft password.
It arrives between a supplier email and a reminder about Friday’s deadline. The subject sounds plausible. There’s a meeting link, a familiar logo and a sign-in page that looks like Microsoft’s.
You’re trying to get into a call. Someone else is hoping you’ll hand over your account details along the way. A diary clash would be the nicer problem.
Counterfeit calendar invitations directing recipients to Microsoft credential-harvesting pages were highlighted in Check Point’s 19 October threat report. They give UK businesses a useful, concrete subject for staff awareness: how to handle a meeting invitation without letting familiarity do all the checking.
Why a meeting invitation can catch people out
Meeting invitations arrive with a ready-made reason to act. There’s a time, an organiser and an apparent expectation that you’ll attend.
A message about an overdue payment might make someone pause. An invitation that appears to come from a customer can feel like ordinary admin, particularly during a busy morning.
The trap can be simple. A link leads to a counterfeit sign-in page, where anything typed into the password field goes to the attacker.
Logos and page layouts can be copied. Seeing Microsoft branding tells you very little about who controls the page. Even the padlock in your browser only indicates an encrypted connection to that website. It doesn’t establish that the website belongs to Microsoft.
Give staff a routine they can actually remember
Ask people to pause when an invitation is unexpected, particularly if it introduces an unfamiliar sign-in step.
The useful question is whether the meeting makes sense. Were they expecting a conversation with that person? Does the subject relate to work they recognise? Is the organiser asking them to do something unusual?
Check the sender’s full email address, rather than relying on the display name. Lookalike addresses and unrelated domains deserve attention. However, a familiar address isn’t a guarantee either, because genuine accounts can be compromised.
If something feels wrong, verify it through a separate, known route. Ring the organiser using a number already on file, or contact them through an existing conversation. Replying to the questionable invitation may simply put you back in touch with the attacker.
Open the meeting app yourself
When an invitation unexpectedly asks for a Microsoft password, close the page and open the meeting app directly.
Use the installed Teams app, a trusted bookmark or your organisation’s usual Microsoft 365 route. Check for the meeting there. If it isn’t visible, contact the organiser independently rather than returning to the suspicious link.
External meetings can involve legitimate browser links and different joining arrangements. The point is to avoid treating an unfamiliar invitation as a trusted route to your account.
For businesses, this habit becomes easier when everyone knows the approved way to access work tools. Put those routes somewhere obvious. A short internal guide is more useful than expecting every member of staff to become an expert in web addresses before their next call.
Good Wi-Fi won’t make a fake sign-in page genuine
A reliable office network helps people work. It doesn’t make every page they visit trustworthy.
Someone can enter their password into a counterfeit page while connected to properly secured business Wi-Fi. The same can happen at home or on a mobile connection. A VPN doesn’t turn a fraudulent website into a legitimate one either.
Network protection still has a role. Depending on your systems and configuration, web filtering or DNS filtering can block access to known malicious destinations. Those controls are useful, but they won’t catch every new or unfamiliar site.
Keep business networking basics in order too. Separate guest Wi-Fi from internal business systems, maintain networking equipment and restrict access to its management settings. These measures address different risks alongside staff awareness and account security.
Make a stolen password less useful
Enable multi-factor authentication on work accounts. It adds protection beyond the password, although some phishing techniques can also capture codes or steal signed-in sessions.
Where your services support it, consider phishing-resistant sign-in methods such as appropriately configured passkeys or security keys. Ask your IT provider which options suit your Microsoft environment and the devices your staff use.
Staff should also know that an unexpected approval prompt needs reporting. Approving it to make the notification disappear can authorise someone else’s sign-in.
Review account permissions as well. Everyday work should happen through ordinary user accounts, with administrator access reserved for tasks that require it. That reduces what an attacker could do if an account is compromised.
Make reporting easier than keeping quiet
People need a clear route for reporting suspicious invitations. Give them a named contact, an agreed support channel or a reporting button they know how to use.
Explain what to include, such as the sender’s address and the approximate time they opened the link. Follow your IT team’s process for preserving the original message without spreading the link around the business.
Most importantly, make it safe to say, “I entered my password.” A quick report gives your IT team a chance to act sooner. A lecture tends to produce quieter staff, which is rather less helpful.
If someone has submitted credentials, they should stop interacting with the page and contact IT immediately through a trusted route.
The response may include resetting the password through the genuine service, revoking active sessions and checking account activity. IT should also review mailbox rules, forwarding settings and any changes to authentication methods. Changing the password alone may leave other access in place.
Put the lesson into the next team briefing
Use an unexpected meeting invitation as a short discussion at your next staff meeting. Explain the warning signs, demonstrate the approved way to open the meeting app and show everyone where to report concerns.
Then ask your IT provider to review the supporting controls, including sign-in protection and network filtering. Keep the staff guidance short enough to remember when the phone is ringing and a customer is waiting.
If you’d like to talk through how your business handles suspicious invitations, account access and network protection, speak to Morse Networks.
Let’s make IT one less thing to think about. morsenetworks.co.uk.
Sources
- 19th October – Threat Intelligence Report — Check Point Research · 19 Oct 2026