8 minhigh
You're Invited to get Phished! Why Invitation-themed Emails Remain Effective
Threat actors are weaponizing event invitation-themed emails spoofing platforms such as Punchbowl, Evite, Paperless Post, and Greenvelope to deliver credential phishing pages and remote access malware. Campaigns use device-detection logic within malicious URLs to serve ConnectWise RAT or Datto RMM to desktop users and credential harvesting pages to mobile users from the same link. Abused legitimate remote access tools bypass automated defenses, and AI-assisted email crafting produces lures visually indistinguishable from genuine platform communications.
Sens:▲ 24hConf:
Showing defanged values
- domainnewlocalpr[.]comSender domain used in a Punchbowl-spoofing phishing campaign delivering ConnectWise RAT.
- emailanna[@]newlocalpr[.]comSender address used in a Punchbowl-spoofing phishing email delivering ConnectWise RAT (ATR 417375). Bypassed Microsoft ATP.
- emaildvesole[@]yahoo[.]comSender address used in an Evite-spoofing phishing email delivering Datto RMM (ATR 416254). Bypassed Cisco IronPort and Microsoft ATP.
- emailjill[.]lynndvm[@]yahoo[.]comSender address used in an invitation-themed credential phishing email spoofing Google login (ATR 417200). Bypassed Microsoft ATP.
- emailkjgarritano[@]gmail[.]comSender address used in a Paperless Post-spoofing email delivering ConnectWise RAT on Windows or credential phishing on mobile (ATR 417310).
- emailknoxvilletim[@]gmail[.]comSender address used in an invitation-themed credential phishing email (ATR 416670). Bypassed Microsoft ATP.
Detection / Hunteropenrouter
What Happened
Attackers are sending fake party invitation emails that look like they come from popular e-invitation services like Punchbowl, Evite, and Paperless Post. When recipients click the link in the email, they are either taken to a fake login page that steals their passwords or their computer is infected with remote access software that lets the attacker control it. The same link can detect whether the recipient is using a phone or computer and deliver different attacks to each. These emails look genuine because attackers are using AI and polished branding to make them convincing. Organizations should train employees to be suspicious of unexpected invitations, use password managers that will not auto-fill credentials on fake domains, and block unauthorized remote access tools from running on corporate devices.
Key Takeaways
- Threat actors are spoofing e-invitation platforms (Punchbowl, Greenvelope, Paperless Post, Evite) to deliver credential phishing and remote access malware.
- A single malicious URL can fingerprint the victim's device and deliver ConnectWise RAT to Windows, credential phishing pages to mobile devices, or Datto RMM to desktops, maximizing campaign yield.
- Invitation-themed emails comprise nearly 15% of malware campaigns and over 3% of credential phishing campaigns observed by Cofense Intelligence.
- Abused legitimate remote access tools (ConnectWise RAT, Datto RMM) bypass automated security defenses because they are recognized IT management products.
- Visual polish is no longer a reliable indicator of legitimacy; threat actors produce invitation lures indistinguishable from genuine platform communications.
Affected Systems
- Windows desktops
- macOS desktops
- Mobile devices
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Threat actor sends invitation-themed email spoofing platforms like Punchbowl, Evite, or Paperless Post with emotional subject lines to elicit clicks.
- Execution: Recipient clicks embedded link directing to attacker-controlled landing page.
- Defense Evasion: Landing page uses device-detection logic to fingerprint the recipient's OS and serve a payload appropriate to the platform.
- Persistence/Control: Desktop users receive ConnectWise RAT or Datto RMM, abused legitimate remote access tools that bypass automated security defenses.
- Credential Theft: Mobile users are redirected to credential phishing pages spoofing services like Google login to harvest usernames and passwords.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
No detection rules are provided in the article. Campaign IOCs are referenced as being available in Cofense Active Threat Reports (ATRs) within the ThreatHQ platform.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | ConnectWise RAT and Datto RMM are legitimate IT management tools. EDR may not flag their execution if the organization uses or allows these tools. Detection depends on identifying anomalous deployment contexts rather than tool signatures. |
| Network Visibility | Medium | Network telemetry can capture connections to attacker-controlled landing pages and subsequent C2 traffic from RATs. However, if RATs use standard HTTPS, distinguishing malicious sessions from legitimate remote support sessions is difficult without destination intelligence. |
| Detection Difficulty | Hard | The campaigns abuse legitimate remote access tools that are commonly allowlisted. Emails are visually polished and bypass major SEGs including Microsoft ATP and Cisco IronPort. Device-detection logic on landing pages complicates static URL analysis. Detection requires behavioral correlation across email, web, and endpoint telemetry. |
Required Log Sources
- Email gateway logs (sender, subject, URL reputation)
- Web proxy logs (URL destination, user-agent strings)
- EDR process execution logs (remote access tool binaries, parent process chains)
- DNS resolution logs
- Authentication logs (failed or anomalous login attempts)
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for remote access tool binaries (ConnectWise, Datto RMM) executing from user-writable directories or with unexpected parent processes such as browsers or email clients, which would indicate delivery via phishing rather than IT deployment. | EDR process execution logs, process ancestry chains, file path telemetry | Execution / Persistence | Medium - legitimate IT administration may deploy these tools via scripts or management agents, producing similar process trees. |
| Consider hunting for emails with invitation-themed subject lines containing phrases like 'RSVP', 'You're Invited', or 'join me for' combined with embedded URLs pointing to newly registered or low-reputation domains. | Email gateway logs, URL reputation feeds, domain age data | Initial Access | Medium - legitimate invitation platforms send similar emails, requiring brand-spoofing detection to differentiate. |
| Consider hunting for web browsing sessions where a single URL serves different content based on user-agent strings, which may indicate device-detection logic used to serve platform-specific malware or phishing pages. | Web proxy logs with user-agent strings, response body analysis | Execution | Low - legitimate websites serving responsive content based on user-agent is common, but serving executable downloads or credential forms conditionally is unusual. |
| Consider hunting for credential submissions to domains that impersonate Google, Apple, or other major identity providers but do not match the legitimate authentication endpoints for those services. | Web proxy logs, DNS logs, authentication logs | Credential Access | Low - credential submissions to non-legitimate identity provider domains are highly suspicious. |
Control Gaps
- Email security gateways (Microsoft ATP, Cisco IronPort) failed to block multiple campaign emails described in the article.
- Allowlisting of legitimate remote access tools (ConnectWise, Datto RMM) permits malicious deployments to execute unchallenged.
- Appearance-based detection by both users and automated filters is unreliable due to AI-assisted email and landing page crafting.
Key Behavioral Indicators
- Remote access tool binaries executing with browser or email client parent processes
- Emails spoofing invitation platforms where the sending domain does not match the displayed brand domain
- URLs serving different payloads based on user-agent or device fingerprinting
- Credential entry on domains that do not match legitimate identity provider endpoints
- Invitation-themed subject lines combined with free email provider sender addresses
False Positive Assessment
Medium - legitimate invitation platforms (Punchbowl, Evite, Paperless Post, Greenvelope) send similar emails routinely. Remote access tools like ConnectWise and Datto RMM are used legitimately by IT teams. Distinguishing malicious from benign activity requires contextual analysis of sender domain, deployment method, and user behavior rather than signature matching alone.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider searching email logs for the sender addresses and domains identified in this report and quarantining matching messages.
- If your EDR supports it, consider isolating any endpoints where ConnectWise RAT or Datto RMM were installed outside of normal IT deployment procedures.
- Consider blocking the sender email addresses and domains listed in this report at your email security gateway if they are not already blocked.
Infrastructure Hardening
- Consider establishing and enforcing a software allowlist for remote access tools. Any tool not on the list, including ConnectWise, SimpleHelp, Atera, and GoTo RAT, should be blocked from installing on corporate devices.
- If a full allowlist is not feasible, consider blocking the digital certificates associated with remote access tools your organization does not use.
- Evaluate whether your email security technology can flag when the sending domain does not match the brand displayed in the email body, as invitation spoofs rely on that mismatch going unnoticed.
- Consider deploying enterprise password managers that will refuse to auto-fill credentials on domains that do not match legitimate services.
User Protection
- Consider updating security awareness training to include current invitation-themed phishing lures, using simulation exercises that replicate the specific scenarios described rather than generic examples.
- Ensure employees have a simple and accessible mechanism to report suspicious emails, as rapid reporting enables security teams to block infrastructure before other recipients click.
Security Awareness
- Consider incorporating training content that explicitly addresses the unreliability of visual polish as a legitimacy indicator, since AI-assisted phishing emails can appear indistinguishable from genuine communications.
- Consider training employees to verify invitation emails through out-of-band channels (e.g., asking the supposed sender directly) before clicking links, particularly for invitations claiming to be from coworkers or family members.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping4 techniques
Tactic
Initial Access
Tactic
Collection
Tactic
