ICLOUD CALENDAR ABUSED TO SEND PHISHING EMAILS FROM APPLE'S SERVERS

Summary from the TLDR InfoSec newsletter

A new phishing campaign that leverages iCloud Calendar invites was reported to BleepingComputer. The phishing email notifies the user that their PayPal account is being charged and requests the user to call a given phone number. The notable thing is that the email is sent from Apple's servers because the attackers add the user's email to an Office 365 group, which they invite to the event, and include the phishing text in the Notes field.