Fake Invitation Phishing Campaign Targets U.S. Organizations With Credential Theft

A large-scale, ongoing phishing campaign (tracked since at least December 2025) is using event-themed invitation lures and CAPTCHA checks to steal login credentials, intercept OTPs, and silently deploy remote access/RMM tools across multiple U.S. sectors; the actors reuse a repeatable framework and identifiable infrastructure (icons, endpoints, domain patterns), and researchers provided IoCs and TI queries to detect related sites.