Cofense reports a sustained rise in real phishing campaigns disguised as party/event invitations that trick people into clicking links. The same invitation lure is being used both to steal usernames/passwords via fake login pages and to install legitimate-but-abused remote access tools that give attackers control of a computer. Some campaigns even change what victims receive based on whether they click from a desktop, Mac, or mobile device.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get a Punchbowl invite: “Birthday party – for desktop only.” Looks legit, nice graphics… and that’s the trap. Cofense is seeing real campaigns spoofing Punchbowl and Evite where that “View Invitation” link either steals your login or quietly installs a remote access tool like ConnectWise or Datto RMM. Here’s the aha: one shiny invite link can do device-detection, on your phone it shows a fake login page, on your Windows laptop it drops a RAT that gives someone full control of your machine. If you get an unexpected invite, especially “for desktop only” or “friends and family” at work, don’t click. Screenshot it and report it through our phishing reporting button.
Cofense reports real phishing campaigns where attackers trick employees into installing legitimate remote access tools (like GoTo, Datto RMM, SimpleHelp, and ConnectWise). After the first tool is installed, it contacts a command-and-control server that directs it to download additional remote tools…
Researchers found a phishing campaign offering a “free” upgrade to Claude Max to trick people into signing in with Google. The page uses a convincing fake, draggable Google login window (“browser-in-the-browser”) to capture credentials, potentially giving criminals access to email, documents, and…
Attackers are sending fake ChatGPT billing emails that pressure people to “update payment” within 48 hours to avoid service interruption. The message links to a convincing look‑alike ChatGPT login page via a Google redirect, aiming to steal OpenAI credentials.
A phishing email posing as a ChatGPT billing notice pressures users to “update payment information” to avoid service interruption. The button routes through a Google redirect and lands on a fake OpenAI login page that captures usernames and passwords before sending victims to an error page.
Cofense observed a real phishing email that impersonates OpenAI/ChatGPT billing to trick users into “updating” payment details. The email uses the real ChatGPT logo, urgency (“48 hours”), and a prominent button to drive clicks to a lookalike ChatGPT login page. Any credentials entered are harvested…
Researchers reported an active, large-scale phishing campaign that starts with links hosted on legitimate Google services, then redirects victims to attacker-controlled sites. The final pages mimic Microsoft sign-in or “identity verification” flows to steal credentials/MFA codes or trick targets…
