Yep, this. A couple years ago, Google Drive sharing was used in a similar way to deliver malware, and Google had to build some new controls. I’m surprised it took the baddies this long to do it with GCal.