A real phishing campaign used a generic online event invitation to trick recipients into clicking RSVP/download links. Victims were sent through a fake CAPTCHA and invitation page, then prompted to download a ZIP containing a legitimate ConnectWise ScreenConnect installer abused as a remote access trojan (RAT). Once run, it gave the attacker remote control of the device with minimal visible signs.
This campaign relied on a generic online event invitation sent by email. The message used vague, emotionally appealing language, phrases like "You are cordially invited" and "Join Us for a Special Gathering, Let Us Celebrate a Milestone", without naming an organizer, date, venue, or any specific detail. Clicking the "Click Here to Download the Invite" button triggered a forced download workflow that routed the victim through a fake CAPTCHA page before landing on a second fake invitation page, again missing any concrete event details.
After passing the CAPTCHA, clicking an "eInvite" button downloaded a ZIP file named ViewDePartyyinvites. Inside was an executable, ScreenConnect.exe, a legitimate ConnectWise ScreenConnect installer repurposed as a remote access trojan. Once run, it gave the attacker full remote control of the victim's device with minimal visible signs of compromise.
The vagueness of the invite was not an oversight, it was deliberate. By avoiding specifics, the email could feel personally relevant to almost anyone without triggering scrutiny over inconsistent details. The CAPTCHA step added a layer of perceived legitimacy, since users commonly associate CAPTCHAs with trustworthy sites rather than malicious ones. The forced download approach also concealed the true destination and nature of the file until it was already on the victim's machine.
Using a legitimate, signed installer like ScreenConnect further reduced suspicion, since security tools and users alike may not flag a known remote-support application as inherently dangerous.
Employees across roles, including HR, finance, executive assistants, and IT helpdesk staff, are common targets for this kind of pretext because invitations and RSVPs are routine parts of their work. Awareness training should reinforce that vague, detail-free invitations deserve scrutiny regardless of how personal they feel. Teams should also be trained to question CAPTCHA prompts that appear mid-click-through from an email, and to treat any unplanned installation of remote access tools as a signal worth reporting, even when the software itself is legitimate.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
The email used a vague invitation with no organizer, date, or venue, asking recipients to click a download button. This led through a fake CAPTCHA page to a ZIP file containing a legitimate ScreenConnect installer abused as a remote access trojan.
Attackers used the CAPTCHA to create a false sense of security, making the malicious page feel more legitimate before delivering the payload.
The ZIP, labeled ViewDePartyyinvites, contained an executable named ScreenConnect.exe, a legitimate ConnectWise ScreenConnect installer repurposed as a remote access trojan.
Be suspicious of vague invitations lacking basic details, forced downloads after clicking a button, and unexpected installation of remote-support tools.
You get an email: “You are cordially invited… Join Us for a Special Gathering.” No date, no place, just a big button: “Click Here to Download the Invite.” Click it, and you’re pushed through a random CAPTCHA page on a domain like theinvitationestateco.vu, then an “eInvite” button silently forces a ZIP download called “ViewDePartyyinvites.” Inside that ZIP is ScreenConnect.ClientSetup.exe, a legit remote-support tool turned into a remote access trojan. If you run it, someone can quietly take over your machine. If an invite email is vague and makes you download a ZIP or run an installer, stop. Don’t open it, forward it to IT security and delete the message.
Cofense reports multiple real-world campaigns where attackers don’t hack the browser, they trick employees by copying normal browser experiences like login pop-ups, software update prompts, and “verification” checks. The goal is to get users to enter credentials, approve attacker sessions, or run…
Researchers observed a real phishing campaign (“CSuite”) heavily targeting U.S. organizations using familiar business-themed lures (DocuSign, Adobe, Zoom/Meet, Dropbox, Microsoft 365). After a victim engages, the attackers either steal Microsoft 365 sessions (enabling mailbox takeover and fraud) or…
Microsoft reported real phishing campaigns that trick users into running a legitimate MSP360 remote-management installer disguised as meeting invites, PDFs, and software updates. After MSP360 is installed, attackers use it to silently install ScreenConnect as a second remote-access path, then use…
Attackers are sending fake calendar meeting invites that can be automatically added to a victim’s calendar, even if the email is blocked. A documented example used a Google Calendar invite with a financial “invoice credit” lure to drive victims to a hosted webpage and download a malicious…
Researchers observed real campaigns where a fake “AI crypto trading agent” website tricked victims into downloading malware that silently replaces browser wallet extensions and steals the wallet password when it’s typed. The same reporting also describes invoice emails using QR codes to push…
A real phishing campaign is targeting DEF CON speakers and attendees through X/Twitter messages pretending to be a Coindesk executive. Victims are sent to a Google document that attempts a “click-fix” trick to get them to paste malicious commands into a terminal or download malware. The goal is to…
