Phishing Campaign Abuses eCards to Deploy RMM Tools

Forescout reported a six-month phishing campaign called SeasonalInvite that lured Windows and macOS users with calendar-themed eCards to download legitimately signed RMM installers (ConnectWise ScreenConnect, LogMeIn Resolve, Kaseya, O&O Syspectr). The operation used a traffic distribution system and hundreds of domains to serve OS-specific installers—abusing UAC prompts and unattended-enrollment features to redirect victims to attacker-controlled consoles—and showed signs of an LLM-assembled kit; Forescout recommends whitelisting approved RMMs, tightening email defenses, and training staff to never install remote support software from eCards.