URGENT FOLLOW-UP – Outlook.com Groups abuse / unauthorized group membership causing calendar spam

Subject: URGENT FOLLOW-UP – Outlook.com Groups abuse / unauthorized group membership causing calendar spam

Dear Microsoft Support, I am following up on the issue I reported previously. I have now been able to investigate the problem further and gather additional evidence. This appears to be more than a normal email spam issue. It seems to involve abuse of the Outlook.com Groups functionality. My personal Outlook.com/Hotmail account is repeatedly being added to newly created Outlook Groups by unknown third parties, without my consent or confirmation. These groups subsequently send meeting invitations. Although the corresponding emails are correctly identified as junk/spam by Outlook, the meeting requests are still processed and propagated to my calendar. Because my Outlook calendar is synchronized with Apple Calendar, the fraudulent invitations appear directly in the Calendar app on my iPhone. The scale of the problem has now become very significant. In less than one day:

• dozens of new unknown Outlook Groups appeared in my account;
• 42 new related messages appeared in Outlook Junk Email;
• 41 new unsolicited meeting invitations appeared in Apple Calendar on my iPhone. I have already tried blocking groups.outlook.com and created Outlook rules specifically targeting invitations addressed to @groups.outlook.com. This does not prevent the calendar invitations from being generated/synchronized. I have also inspected the full message headers and calendar data of these messages. They show that the visible sender is typically a random Hotmail/Outlook account, while the invitation is sent through a newly created @groups.outlook.com group. The messages contain genuine text/calendar; method=REQUEST calendar requests, and the headers contain Outlook Group expansion information. Therefore, simply blocking individual senders is ineffective: the attackers continuously use new sender addresses and create/use new Outlook Groups. The fundamental issue I would like Microsoft to investigate is this: How can unknown third parties repeatedly add my personal Outlook.com account to Outlook Groups without my approval, and subsequently use those memberships to deliver unsolicited calendar invitations to my account? I consider this a potential Outlook.com Groups abuse/security issue rather than a conventional spam-filtering problem, because the unwanted group membership itself appears to provide a route for injecting meeting requests into the calendar ecosystem despite Outlook already classifying the associated messages as spam. Could you please escalate this case to the appropriate Outlook.com Groups / Abuse / Security engineering team, rather than treating it solely as a junk-email filtering issue? I can provide screenshots, complete email headers, MIME source and the embedded ICS/calendar data of individual examples if required. I would particularly like to know whether Microsoft can:

1. prevent unknown users from adding my account to Outlook.com Groups without my consent;
2. block or disable unsolicited Group memberships on my account;
3. prevent meeting requests originating from such Groups from being propagated to my calendar; and
4. investigate whether this represents a wider abuse vector in Outlook.com Groups. Kind regards, Lieven