UCLA Information Security Office is seeing phishing delivered as Google Calendar invites rather than traditional emails. Attackers are abusing Google Calendar to make fake invoice notifications appear on your calendar.
What to watch for
• A calendar invite titled “INVOICE” showing up on your calendar, not in your inbox.
• Message text claiming a PayPal Bitcoin purchase with details like “Transaction ID: TXN-3496742” and “PAID / CLEARED.”
• Urgent instructions to call immediately for support
• External organizer - carpenter7919@bonitads[.]online
• Event date/time in the invite has a hidden guest list
• Unusual delivery method: real PayPal invoices arrive by email or through the PayPal app, never as calendar invites.
What to do
• Do not call the number. Do not accept or interact with the invite.
• In Google Calendar: open the event → Report spam or Report phishing, then Delete. If already accepted, remove it and select I didn’t create this when prompted.
• In Outlook: use Report Phish. You can also forward the invite notification as an attachment to security@ucla.edu.
• Verify PayPal activity only through the official PayPal website or app.
• If you called or provided information, contact the IT Security team immediately and notify your bank/credit card provider.
Subject: Invitation: PayPal Payment Confirmation For BTC @ Wed Sep 10, 2025
From: Una Pullman <carpenter7919@bonitads[.]online>
INVOICE
Invoice Number: INV- 623805
Transaction Date: 2025-09-10
Summary:
This document certifies that a payment of $105.52 has been processed from your PayPal account.
The funds were applied directly to a Bitcoin purchase, linked to PayPal Transaction ID: TXN - 3496742.
This invoice validates the transaction as successfully completed.
Transaction Details:
Purchased Item: Bitcoin (BTC)
Transaction Medium: PayPal
Total Settled Amount: $105.52
Payment Information:
Paid With: PayPal Wallet
Reference Transaction: TXN - 3496742
Payment Condition: PAID / CLEARED
Notes:
Transactions involving digital currencies are irreversible once confirmed.
Please ensure you have received the correct balance in your wallet.
In the rare case that you did not initiate this action, it is mandatory that you reach out to our support hotline immediately at +1 (828) 800-3664.
Our representatives will guide you through dispute handling and security checks.
Helpline:
For urgent support, please call +1 (828) 800-[3664] without delay.
When
Wednesday Sep 10, 2025
Organizer
Una Pullman
carpenter7919@bonitads[.]online
Guests
(Guest list has been hidden at organizer's request)
Report Scams
If you receive a suspicious email, do not click on any links, open any attachments, scan QR codes, send payment, or supply any credentials. Please do not reply to the email and immediately contact security[@]ucla.edu and report it to your IT team.
