WTF is going on with my phone's calendar?

I'm getting events added to my Galaxy phone's calendar. One was supposed to be an invitation to confirm my $400 order with McAfee, (this happened twice in the last week, and another similar one for a Microsoft service that popped in while I was looking at and deleting the first one. It literally appeared while I was looking at it, and was scheduled for about 3 hours later tonight. I deleted it immediately. Scam emails and text messages I can understand, but how in the hell are they putting this shit in my phones calendar? They have a lot of text in them and links that appear as phone numbers. Has anyone else experienced anything like this? I'm worried I've got some kind of mal-ware on my phone...