Impersonated Evite and Punchbowl invitations used for credential phishing and malware distribution · Blog · Sublime Security

Sublime’s Attack Spotlight details active invitation-themed email campaigns impersonating brands like Evite and Punchbowl that deliver credential-phishing pages and malicious RMM payloads (e.g., MSI/EXE installers). The report includes observed hosting domains (pages.dev, r2.dev, storage.googleapis.com, workers.dev, restoreds.de), example malicious filenames, variant behaviors (Cloudflare Turnstile redirects, fake multi-provider login flows, auto-downloaded RMM tools), and detection signals used to block them.