Invitation Emails Used to Steal Logins & Install RATs

Cofense reports a sustained rise in real phishing campaigns disguised as party/event invitations that trick people into clicking links. The same invitation lure is being used both to steal usernames/passwords via fake login pages and to install legitimate-but-abused remote access tools that give attackers control of a computer. Some campaigns even change what victims receive based on whether they click from a desktop, Mac, or mobile device.

Key findings

• Invitation-themed emails are being used in real campaigns to deliver both credential phishing pages and remote access malware.
• Attackers spoof well-known invitation brands (Punchbowl, Greenvelope, Paperless Post, Evite) and rely on curiosity and emotional triggers to get clicks.
• Some campaigns use device-detection so the same link can deliver different payloads to Windows, macOS, or mobile users from a single URL.
• Polished design and branding can be indistinguishable from legitimate invitations, making appearance-based trust unreliable.
• Abused legitimate remote tools (e.g., ConnectWise RAT/ScreenConnect, Datto RMM) can slip past defenses because they are commonly used by IT teams.

Who’s being targeted

• Commonly targeted roles: All employees, Executives, Finance, HR, IT/Helpdesk.
• Attack channels: email, website.
• Impersonated: Punchbowl (spoofed invitation platform), Evite (spoofed invitation platform), Paperless Post (spoofed invitation platform).

Awareness takeaways

• Treat unexpected invitations as risky, even if the branding looks perfect, and verify via a separate, known-good method.
• Be cautious of emotionally charged subject lines designed to create urgency or curiosity (“don’t miss out”, “friends and family”).
• Assume a single link can lead to different outcomes (credential theft on mobile, malware on desktop). Avoid clicking and report it.
• Harden controls around remote access tools and don’t install unexpected “support” or “viewer” software prompted by an email.

Red flags to watch for

• Subject line pressures a specific device use (e.g., “for desktop only”)
• Unexpected invitation, possibly using a familiar name to reduce suspicion
• Clicking leads to download behavior rather than simply viewing event details
• Emotional language meant to override normal caution (e.g., “friends and family”)
• Unexpected invitation from outside normal work context
• Link click leads to software/tool delivery rather than a normal RSVP page
• Same link behaves differently depending on device (unexpected redirects/downloads)
• Mobile click prompts for credentials unrelated to a normal invitation flow
• Invitation appears highly polished, making brand/visual checks unreliable