Microsoft has documented an active campaign against hotels that relays phishing through Calendly and Google so the mail authenticates cleanly. The lesson for the email industry is blunt. Authentication proves who is allowed to send, not what the message is for.
Microsoft has warned that attackers are routing phishing through trusted services so the messages slip past email authentication, in an active campaign against hospitality organisations across Europe and Asia that it disclosed on 25 June 2026. Microsoft Threat Intelligence calls the technique authentication laundering. The phishing mail is relayed through Calendly’s notification infrastructure and Google’s URL redirects, which means the direct Calendly path passes SPF, DKIM and DMARC even though the email is one link in a malicious chain. The campaign has been running since April 2026.
The mechanism is the part that matters: SPF, DKIM and DMARC were built to confirm that a message was sent from infrastructure authorised to send for a given domain. They were never built to judge whether the content is safe. Microsoft says the threat actor registered a Calendly account and used its notification system to relay lures to hotel staff. Because that mail genuinely originates from Calendly’s authorised sending infrastructure, it authenticates as Calendly mail. The display name on every message reads “Booking Manager (via Calendly)”, a nudge aimed straight at booking and reception workflows.
The lures are deliberately generic. Microsoft observed subject lines about guest complaints, room enquiries, bedbug reports and inspections, written in Japanese, Danish and Dutch, with no recipient or property named. That points to high-volume, list-driven sending rather than tailored spear-phishing. The targets are front-desk, reception and reservations staff, the people trained to open messages from strangers fast.
The chain after the click launders trust a second time. The link walks the victim from Calendly through a Google redirect, share.google and then google.com, to a freshly registered, Cloudflare-fronted .cfd domain sitting behind a Turnstile challenge that doubles as an anti-analysis and geolocation gate. Only then does the photo-themed ZIP land. Inside sits a shortcut disguised as an image, named IMG-numbers.png.lnk in the first wave and PHOTO-numbers.png.lnk in the second. Opening it fires obfuscated PowerShell, which Microsoft watched evolve through seven obfuscation phases, and installs a Node.js implant that persists through the registry and beacons to command-and-control servers on non-standard ports.
Microsoft has not pinned the campaign on a known group, and it cannot yet say what the operators want. The access is durable and the behaviour looks like reconnaissance, the kind that often precedes something more destructive. Its findings line up with earlier reporting from SOC Prime and ITOCHU on the same hotel phishing and shortcut-to-PowerShell-to-Node.js chain.
For the email industry, the uncomfortable gap is now on the record. Authentication confirms authorised sending infrastructure. It says nothing about intent. When a reputable multi-tenant platform lets any user generate notification mail, a single malicious account can borrow that platform’s authenticated reputation and its clean DMARC result. Notification and transactional streams that carry user-controlled links are the exposed surface, and Calendly is only the example that got named.
That reframes the question for everyone scoring this mail. For senders and ESPs, the risk is that well-authenticated, well-reputed infrastructure becomes a relay for one bad tenant, which makes per-subaccount monitoring and link hygiene a frontline control rather than a nicety. For mailbox providers, a passing DMARC paired with a strong SaaS domain reputation is a weak proxy for message safety, so content, URL and redirect-chain signals have to carry the load. The Google hop makes the same point about link reputation that the Calendly hop makes about sender reputation. Trusted infrastructure was used to launder both.
Microsoft’s own advice is to hunt the behaviour, not the indicators. It points to photo-themed ZIP archives, unusual PowerShell, Node.js running from user-profile directories, .NET compiled by PowerShell, and changes to Defender exclusions.
On the email side the takeaway is simple: Authentication is a hygiene baseline, not a trust verdict. SaaS notification mail is now a category to be scrutinised on content and links, not a lane to simply wave through.
