I’ve been getting crypto currency spam emails today with .ics attachments (vcalendar files). Wondering if anyone else has been seeing them. The attached calendar file includes a link to a docs.google.com page. Here’s the strings output from one of the files I got today (with defanged URL links):
BEGIN:VCALENDAR
PRODID:-//Google Inc//Google Calendar 70.9054//EN
VERSION:2.0
CALSCALE:GREGORIAN
METHOD:REQUEST
BEGIN:VEVENT
DTSTART;VALUE=DATE:20230613
DTEND;VALUE=DATE:20230712
DTSTAMP:20230613T140219Z
ORGANIZER;[email protected]:mailto:[email protected]
CREATED:20230613T140219Z
DESCRIPTION:Invite 6357115
-
https://docs[.]google[.]com/drawings/d/1e6dMzCpnHuVI46vkmqmxwK1p6OLZjjtfiySgYRvRGWM/preview?436604
LAST-MODIFIED:20230613T140219Z
LOCATION:
SEQUENCE:0
STATUS:CONFIRMED
SUMMARY:her me past the of of story
TRANSP:TRANSPARENT
END:VEVENT
END:VCALENDAR