Cybercriminals are developing a new method of attack by exploiting Google Calendar invites to deliver malware. This innovative approach uses an advanced obfuscation technique, hiding malicious code behind a seemingly harmless single character.
This tactic underscores the growing sophistication of cyber threats, as attackers find ways to circumvent standard security protocols by leveraging trusted platforms.
In a notable finding from March 2025, researchers at Aikido uncovered a dubious npm package named “os-info-checker-es6.” While the package appeared to simply gather system data, further inspection revealed it was masking dangerous code. The red flag was a vertical bar (“|”) character, which, in reality, concealed a far more dangerous payload.
Malicious Payload Hidden in a Single Character
“Our findings were truly eye-opening—what appeared to be a simple pipe symbol was, in fact, a carrier for hidden Unicode Private Use Area (PUA) characters,” the researchers explained in their report.
PUA characters, which are part of the Unicode standard reserved for private use, are non-printable by nature, making them an ideal tool for concealing malicious code.
Once decoded, the seemingly harmless character revealed a base64-encoded command sequence, which initiated communication with Google Calendar for remote control and execution of further operations.
Google Calendar Invites as a Malware Delivery Mechanism
Further analysis uncovered that the malware utilized Google Calendar invites to distribute harmful payloads. These invites contained base64-encoded strings that, once decoded, directed victims to a server controlled by the attackers, facilitating the deployment of the malicious software.
Google Drive Exploited in New Attack Technique
“This marks a troubling shift in cyberattack strategies,” Charlie Eriksen told Cyber Security News. “By exploiting Google Calendar, a widely trusted tool, attackers can bypass typical email security filters that would otherwise flag malicious attachments.”
Researchers at Check Point have observed similar tactics, where cybercriminals manipulate email headers to make it seem as though harmful messages are sent directly from Google Calendar.
When users interact with these deceptive calendar invitations, they are often redirected to counterfeit websites designed to steal sensitive information such as login credentials or financial data.
The attackers didn’t stop with just one malicious package. Security analysts discovered several npm packages affected by this attack method:
- skip-tot
- vue-dev-serverr
- vue-dummyy
- vue-bit
Each of these packages included the harmful “os-info-checker-es6” as a dependency, expanding the reach of the attack.
How to Protect Yourself
Google has acknowledged the threat and advised users to activate the “known senders” feature in Google Calendar to help block phishing attempts. Additionally, security professionals recommend the following precautions:
- Be cautious with unexpected calendar invites, especially those set far in the future.
- Confirm the identity of the sender before accepting invitations or clicking on links.
- Ensure your software is always up-to-date to fix known security vulnerabilities.
- Report any suspicious invites through Google Calendar’s spam reporting tool.
This attack highlights the ever-evolving tactics of cybercriminals, who continue to innovate by using trusted platforms and complex obfuscation methods to deliver malicious payloads.
By embedding harmful code in what seems like a harmless single character and using Google Calendar as a delivery vehicle, attackers have introduced a concerning new attack method that threatens both individual users and organizations alike.
