
Switch the Invitations option away from in-app notifications to avoid calendar event spam.
In the Invitations section, change the option from In-App Notifications to Email to iCloud Address. Click the gear icon in the lower-left corner. (Apple doesn’t allow you to use via mobile Safari.) ICloud Calendar page via a desktop browser. Because iCloud handles the behavior for incoming email, you have to make the change at the iCloud website: The best option, however, is to disable this automatic invitation parsing altogether. In iOS, you can slide left and then choose Delete, which removes the invitation without providing a response. (This assumes the inviting account or server hasn’t been shut down already.) However, no matter what you click, that response is sent back to the inviter, which will surely trigger more spam, because they know your account received the request and you interacted with it. If you click the invite, you can respond with Accept, Decline, or Maybe. Previous batches tried to trick people into visiting DHL and other sites, but the current large wave is designed to entice an unwary user into clicking it for a bargain. This spam includes a URL in the event description. By default, an iCalendar invitation gets extracted and shown to you in all your linked calendars in iOS and macOS.
Apple automatically examines ICS attachments sent via email to your iCloud email account, whether or not it’s from a known recipient.
The standard iCalendar format can package an invitation in an ICS file, a format you’re probably familiar with for adding events from other calendar services or subscribing to a school or sports calendar via a website.