#PacketHunters – HTML smuggling in Calendar invites (aka the .ics you didn’t inspect)
What looks like a harmless calendar invite can be a hidden delivery system.
Attackers are now embedding base64-encoded HTML payloads inside .ics files — turning “urgent meeting” requests into stealth phishing and credential traps. In this week’s #PacketHunters, we dissect how HTML smuggling works inside calendar invites, how different mail clients handle it, and how to simulate it safely before the attackers do.