Cofense reports a sustained rise in real phishing campaigns disguised as party/event invitations that trick people into clicking links. The same invitation lure is being used both to steal usernames/passwords via fake login pages and to install legitimate-but-abused remote access tools that give attackers control of a computer. Some campaigns even change what victims receive based on whether they click from a desktop, Mac, or mobile device.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get a Punchbowl invite: “Birthday party – for desktop only.” Looks legit, nice graphics… and that’s the trap. Cofense is seeing real campaigns spoofing Punchbowl and Evite where that “View Invitation” link either steals your login or quietly installs a remote access tool like ConnectWise or Datto RMM. Here’s the aha: one shiny invite link can do device-detection, on your phone it shows a fake login page, on your Windows laptop it drops a RAT that gives someone full control of your machine. If you get an unexpected invite, especially “for desktop only” or “friends and family” at work, don’t click. Screenshot it and report it through our phishing reporting button.
Cofense reports real phishing campaigns where attackers trick employees into installing legitimate remote access tools (like GoTo, Datto RMM, SimpleHelp, and ConnectWise). After the first tool is installed, it contacts a command-and-control server that directs it to download additional remote tools…
Threat actors sent fake invitations to an exclusive Anthropic AI preview to steal Google and Microsoft work credentials. The campaign abused trusted services, including GoTo Webinar and a URL shortener, then used CAPTCHA pages and convincing fake login screens to make detection harder. Employees…
Microsoft and partners disrupted three "phishing-as-a-service" kits that enabled criminals to send more than a billion phishing emails and SMS messages worldwide. The kits provided ready-made fake brand pages (government, finance, logistics, consumer brands) designed to steal login credentials and…
Attackers are sending calendar invitations that auto-appear in tools like Google Calendar, tricking people into clicking links or calling “support” numbers. The calendar event often mimics voicemails, payment receipts, or auto-renewals and leads to fake login pages (Microsoft/Google/PayPal) or…
Researchers demonstrated how attackers can register lookalike web domains using two specific Unicode characters that Chromium-based browsers may display as trustworthy, normal-looking URLs. This can make phishing and typosquatting sites appear legitimate to employees, increasing the chance they…
Researchers uncovered a human-run phishing platform that pretends to be ad-management products for popular AI brands (ChatGPT, Gemini, Claude, and others). Victims are pushed to click a “Connect” flow that opens a convincing fake login window (showing trusted domains like accounts.google.com) to…
