These invites sneak past your security software to embed themselves in your calendar. But you can thwart them before they do any damage.