Phishing Campaign Uses Fake Party Invites to Deliver Remote Access Tools

A Symantec analysis details a highly active phishing campaign that uses party-themed and other lures (invoices, meeting invites, tax notices) to convince victims to install legitimate remote management and monitoring (RMM) software. Attackers rotate and chain installations of RMM tools (ScreenConnect, LogMeIn Resolve, Naverisk) to evade detection and maintain long-term access; researchers suspect the group may be selling access to other criminals such as ransomware gangs.