{"success":true,"data":{"id":"calendar-invite-phishing","label":"Calendar invite phishing — .ics from freemail with phishing language","description":"Email contains a calendar invite (.ics/.ical attachment) from a free webmail or suspicious-TLD sender, AND the body contains phishing language (\"verify your\", \"confirm your attendance\", \"click here to accept\", \"your calendar has been updated\", \"accept this invitation\") paired with URL shorteners or suspicious TLDs. Calendar invite phishing auto-adds malicious events to victims' calendars with phishing links. The .ics attachment protection in isSafeToDelete still prevents deletion — the email routes to REVIEW so the user is warned but the sacred rule is preserved.","tier":"danger","category":"phishing","isThin":false}}