Fake Invitation Phishing Is Becoming a Remote Access Problem for CISOs  

A large-scale phishing campaign targeting U.S. organizations uses fake event invitations and CAPTCHA-driven flows to harvest credentials, intercept OTPs, and silently install legitimate RMM software (e.g., ScreenConnect, Datto RMM, ConnectWise, ITarian, LogMeIn Rescue). The report highlights repeatable URL/resource patterns, operator instructions indicating a shared phish kit, and the operational blind spot where legitimate-looking activity evades signature-based controls; it recommends interactive sandboxing (ANY.RUN) to observe behavior, gather IOCs, and accelerate confident containment.