ANY.RUN researchers uncovered a large-scale phishing campaign targeting U.S. organizations with fake event invitations that can steal credentials, intercept OTPs, or install trusted remote management tools. The activity uses repeatable infrastructure and lure pages to scale attacks across domains while making detection harder for SOC teams. #ANYRUN #ScreenConnect #DattoRMM #ConnectWise #LogMeInRescue
Keypoints
- ANY.RUN identified nearly 160 suspicious links and around 80 phishing domains tied to the fake invitation campaign.
- The campaign targets U.S. organizations and appears to affect Education, Banking, Government, Technology, and Healthcare sectors most heavily.
- Attackers use fake event invitation pages and CAPTCHA checks as the initial lure before steering victims toward credential theft or RMM tool delivery.
- Some pages steal email credentials and OTP codes, while others install legitimate remote management tools such as ScreenConnect, ITarian, Datto RMM, ConnectWise, and LogMeIn Rescue.
- The infrastructure is highly reusable, with shared URL patterns, fixed resource paths, and repeated request chains that can help defenders hunt for related activity.
- For CISOs, the main risk is delayed detection and response because early phishing signals can look routine before account compromise or remote access occurs.
- ANY.RUN says its sandbox and threat intelligence help teams validate suspicious links faster and connect related domains, pages, and behaviors.
MITRE Techniques
- [T1598.003 ] Phishing: Spearphishing Link – Victims are directed to fake event invitation pages through suspicious links that begin the attack chain (‘fake event invitation pages as the main lure’).
- [T1056.003 ] Input Capture: Web Portal Capture – The phishing pages collect entered email addresses, passwords, and OTP codes through login and submission forms (‘the page sends a POST request… submitting the email address and password’ and ‘submitting the OTP code’).
- [T1105 ] Ingress Tool Transfer – The campaign delivers remote management tools to the victim system via automatic or user-initiated downloads (‘deliver legitimate remote management tools such as ScreenConnect, ITarian, Datto RMM, ConnectWise, and LogMeIn Rescue’).
- [T1219 ] Remote Access Software – Legitimate RMM products are installed to provide the attacker with trusted remote control or access (‘delivery of remote management tools’ and ‘remote access tool running inside the environment’).
- [T1036 ] Masquerading – The infrastructure and pages imitate legitimate services and event-related content to appear trustworthy (‘fake event invitation’, ‘disguised as a Google authorization form’, and infrastructure designed to look legitimate’).
- [T1566.002 ] Phishing: Spearphishing Link – The campaign uses lure pages and service-selection flows to trick users into credential submission (‘the user is shown an event invitation message and prompted to sign in’).
- [T1110.001 ] Brute Force: Password Guessing – The page prompts a second password entry after an intentional ‘Incorrect Password’ message, capturing another attempt (‘After the first password entry, the page always displays an “Incorrect Password” message’).
Indicators of Compromise
- [URL Paths ] phishing infrastructure and credential-processing endpoints – /blocked.html, /favicon.ico, /Image/*.png, /processmail.php, /process.php, /pass.php, /mlog.php, and /check_telegram_updates.php
- [File Names / Web Assets ] repeated service-icon filenames used on lure pages – office360.png, google.png, and yahoo.png
- [Domains ] event-themed phishing domains observed in related analysis – festiveparty.us, getceptionparty[.]de, and celebratieinvitiee[.]de
- [SHA-256 Hashes ] hashes for repeated icon files hosted under /Image/*.png – 887bc414bdb32b83dcfccdd3c688e90d9a87a0033e3756a840f9bdd2d65c5c74, 6eaa0a448f1306bcf4159783eeafe5d37243bd8ca2728db7d90de1929241dd29, and other 4 hashes
- [URLs ] repeatable phishing URL structure used across domains – hxxps://
/ /Image/office360.png, hxxps:// / /processmail.php, and hxxps:// /blocked.html
Read more: https://any.run/cybersecurity-blog/us-fake-invitation-phishing/