Phishing Campaign Abuses Event Invitations To Target U.S. Firms

This report details a widespread phishing campaign impersonating corporate event invitations to target U.S. organizations—particularly in banking, government, technology, and healthcare—combining credential harvesting and OTP interception with stealthy installation of legitimate RMM tools (ScreenConnect, ITarian, Datto RMM) to bypass MFA and obtain persistent remote access; the attack leverages CAPTCHA gating and AI-generated pages and leaves repeatable early-stage network patterns defenders can use to detect and stop the intrusion before credential theft occurs.