We first wrote about iCloud calendar spam back in 2016. At the time, spammers had figured out a way to send calendar invitations to users which were similar to spam emails, touting sales or other scams. We’ll leave that information below; while this sort of calendar spam seems to have subsided somewhat, the methods we described can be useful against spammers who still use the older tactics.
But now, in 2021, there’s a more common type of iCloud calendar spam. People may find that they are prompted to subscribe to calendars on hacked websites, and, if they accidentally tap or click Subscribe, they may find a new calendar in their app with nothing but spam. Here’s a long Reddit thread discussing this.
This is enough of a problem that Apple has produced a short video explaining how to unsubscribe from these spam calendars.
Apple really needs to do something about these calendar scams. pic.twitter.com/BIVS0EIWpf
— matt (@bieberfluid) June 20, 2021
The fix is relatively easy, at least if you’ve got an iPhone or iPad with the latest operating system. First, if you see this sort of calendar, don’t believe what it says. You can follow Apple’s instructions in the video above—or better yet, follow our more comprehensive steps below—to delete the calendar, and don’t subscribe to any calendars that you do not want.
As Apple explains in the video above, the steps in this specific scenario are pretty simple:
If that doesn’t resolve the problem, or if you have a different operating system and these steps aren’t applicable to you, keep reading.
If you have an iPhone that isn’t running iOS 14.6 or later, you should upgrade to the latest version of iOS if possible by going into the Settings app, then General, then Software Update. After the update completes, follow the steps outlined above for iOS 14.6 or later.
However, if your iPhone is stuck with iOS 12.5.x or earlier, or if you cannot upgrade to iOS 14.6 or later for some other reason, you should upgrade to a newer iPhone as soon as possible to increase your security and privacy. But in the mean time, you can try the following steps to resolve the calendar spam problem:
If you’re still seeing calendar spam after that, Apple suggests that you try deleting the calendar subscription via the Settings app:
If you’re experiencing a problem with spam calendars on macOS, the process is a little different:
*As an alternative to step 3, an Apple support document suggests that you can instead click on the spam calendar’s name in the left side of the window, then click on the Edit menu and click Delete, and then click Delete again to confirm.
But what if you still see spam events on your calendar? If you’ve followed the steps above that are relevant for your operating system but the problem isn’t fully resolved, you may have inadvertently added individual spam invitations from your e-mail inbox, or perhaps from the Web or another source. Keep reading to learn how you can resolve that problem.
(The rest of this article is based on what we originally published in 2016. Although you may be more likely to get invited to spam calendars as described earlier in the article, it’s still possible that you may encounter individual spam calendar events. Here’s how you can delete those individual spam events, which usually get into your calendar via spam e-mails or via a .ics or other file downloaded from a malicious Web site.)
You thought you had enough spam already, right? You get spam in your email, in Messages, on Twitter and Facebook, and on any other social media app. But now, Mac and iOS users are getting hit with calendar spam. This type of iCloud spam sends you an invitation to an “event,” which informs you of some product you can buy, or tries to scam you.
You may be familiar with calendar invitations. You can use invitations when telling friends about a party, or informing colleagues about a meeting. You create an event in your calendar, add a number of users’ email addresses, and then click Invite. Through the magic of iCloud, these users get in invitation in their calendar, on their devices.
Spammers have discovered a way to exploit the iCloud calendar invitation system. They’ve been sending invitations to tout sales, which probably aren’t legitimate sales, but could be attempts to get people to give up their credit card numbers or personal information, or may lead them to sites where they’ll download malware.
Here’s one I got last week, just before Black Friday:
As you can see above, there are three options to respond to the spam: Decline, Maybe, and Accept. Don’t click on any of these options! Clicking any of these can signal to the spammers that your email address is valid, which will naturally add you to a list of verified active addresses that they can sell to other spammers. So beware, you may end up getting even more spam if you respond to these invitations. I’ve only gotten a few spam invitations, but some people I know have gotten dozens, perhaps because they declined one of them, indicating that their addresses were valid.
So how can you deal with iCloud calendar spam? For now, since Apple hasn’t yet figured out a way to block the spam, there are a couple ways to get rid of or avoid it.
If you only have a single spam event on your calendar, you can of course just delete it and be done with it. But if you have several spam events, and you’ve already confirmed that you’re not subscribed to a spam calendar (see the first half of this article), then you may have multiple individual spam events on your calendar that you’ll want to clean up.
The first way to delete iCloud calendar spam invitations is to create a new temporary calendar; call it Spam, for example, or give it any name you wish. The methods to set this up are different on Macs compared to iOS devices, as detailed below.
If you’re receiving a lot of invitation spam, you could alternatively keep this calendar rather than deleting it, and instead just choose to not display it. In this case, you can more easily funnel the spam to the calendar without having to recreate and delete it every time. But there’s another way that you may want to consider, as follows.
The above process to create a spam calendar takes a while, which can be annoying. There’s an alternative way to get rid of this spam, but you should be aware that it will change the way you deal with all calendar event invitations—including legitimate ones.
First, log into iCloud.com, preferably in Safari on your Mac. (If you don’t have a computer, go to iCloud.com in Safari on your iOS device. Tap and hold the reload button in the address bar, and then choose Request Desktop Site. You’ll be able to follow the rest of these instructions, but the display won’t be optimized for a smaller screen, such as an iPhone.)
Click the Calendar icon, and then click the gear icon at the bottom left of the window. Choose Preferences > Advanced. In the Invitations section at the bottom of the window, check the radio button that says Email to [your email address].
When you do this, you won’t receive invitations any more in Calendar, or any other calendar app, if you don’t use Apple’s. Instead, you’ll get emails, and they’ll contain links to accept invitations. If you get a spam invitation—such as the one below—you can just delete it.
The above methods to get rid of calendar spam are only stopgap solutions. Apple needs a way of blocking this sort of spam, such as an Ignore button, or even a Report button, so Apple can act on spam more efficiently.
Apple has made some efforts behind the scenes to try to deal with this; in fact, after mentioning the problem to @AppleSupport on Twitter, I was contacted by a senior Apple support advisor to collect information about the spam that I got so their engineers could examine it.
Let’s hope that Apple will indeed implement a better fix for the calendar spam problem in the future. In the meantime, the above solutions should help you deal with this problem.
We talked about iCloud calendar spam and more in episode 194 of the Intego Mac Podcast.
You can also subscribe to our e-mail newsletter and keep an eye here on Mac Security Blog for the latest Apple security and privacy news. And don’t forget to follow Intego on your favorite social media channels: Facebook, Instagram, Twitter, and YouTube.
