Targeted Large-Scale Campaign Attacking U.S. Organizations with Fake Event Invitations

A large-scale phishing campaign targets U.S. organizations in high-value sectors using fake event invitations and AI-assisted phishing pages to capture credentials and intercept OTPs, then quietly installs legitimate RMM tools (ScreenConnect, ITarian, Datto RMM) to establish persistent access; defenders are advised to watch for unauthorized RMM installations, suspicious outbound connections, CAPTCHA-based redirect chains, and predictable web request patterns such as /favicon.ico → /blocked.html and fixed resource paths like /Image/*.png.