Phishing Invite Uses Fake RSVP Pages to Install a ScreenConnect-Based RAT
Summary
Cofense reports a phishing campaign using fake event invitations and CAPTCHA pages to deliver an abused ScreenConnect installer that gives attackers remote access to infected devices.
Key points
- The campaign uses vague event-invitation emails to exploit curiosity and encourage recipients to click a download button.
- The link redirects users through a CAPTCHA page to a second fake invitation page, where clicking “eInvite” downloads a ZIP archive.
- The archive contains a ScreenConnect installer abused as a remote access trojan; execution gives the attacker remote access to the device.
- The article identifies the infection and payload URLs as hxxps://theinvitationestateco[.]vu/EdesktopInvite/ and hxxps://theinvitationestateco[.]vu/EdesktopInvite/RsvpNow/invitedetails[.]php.
- Cofense recommends employee training to recognize and report phishing; the article notes similar threats have appeared in environments protected by secure email gateways.
Article Details
- Attack Vectors
- A phishing email disguised as an event invitation uses a vague subject and a forced-download button to entice recipients to click.
- The link redirects users to a CAPTCHA page and then a fake invitation page, where clicking “eInvite” downloads a ZIP archive containing ScreenConnect.exe.
- The article reports that the executable abuses remote-support software to provide the attacker remote access to the compromised device.
- Defensive Notes
- Train employees to recognize and report vague or unsolicited event invitations and unexpected download prompts.
- Treat CAPTCHA pages on newly registered, generic, unbranded domains as suspicious, and verify invitation details before downloading files.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 104[.]21[.]73[.]121 | IP listed as associated with the observed infection and payload URLs. |
| IPV4 | 172[.]67[.]162[.]73 | IP listed as associated with the observed infection and payload URLs. |
| MD5 | 739a54032b89432bb4c9c33969f6b383 | MD5 hash of the discovered malicious file, ScreenConnect.ClientSetup.exe. |
| SHA256 | f3aab811ae8163e09db40db201facc7e189d1a1b161be265202ca54b39b5e6cc | SHA-256 hash of the discovered malicious file, ScreenConnect.ClientSetup.exe. |
| URL | hxxps[:]//theinvitationestateco[.]vu/EdesktopInvite/ | Observed infection URL used in the malicious invitation campaign. |
| URL | hxxps[:]//theinvitationestateco[.]vu/EdesktopInvite/RsvpNow/invitedetails[.]php | Observed payload URL in the malicious invitation campaign. |
MITRE ATT&CK
T1204.002 · Malicious FileThe malware executes after the recipient downloads and runs the ScreenConnect executable.T1219 · Remote Access ToolsThe article says the executable abuses ScreenConnect remote-support software to provide the attacker remote access.T1566.002 · Spearphishing LinkThe campaign uses a phishing email containing a link that leads recipients through pages to a malware download.