Fake Invitation Phishing Campaign Steals Credentials From U.S. Organizations

A large-scale phishing campaign leveraging fake event invitations is actively targeting U.S. organizations, combining credential theft, OTP interception, and remote access tool abuse into a single attack chain.

The campaign stands out due to its repeatable phishing framework, which allows threat actors to rapidly generate event-themed lure pages at scale.

These pages often begin with a CAPTCHA verification step, typically using Cloudflare, followed by a convincing invitation interface.

While this initial flow appears routine to users and security systems, it serves as the gateway to more dangerous actions, including credential harvesting or silent delivery of remote monitoring and management tools.

ANY.RUN analysis revealed nearly 160 suspicious links and approximately 80 phishing domains tied to the campaign as of late April 2026.

Many of these domains were registered under the .de top-level domain and contain event-related keywords such as “party,” “invite,” or “celebration,” reinforcing the social engineering theme.

This infrastructure enables attackers to continuously rotate domains while maintaining consistent backend patterns.

Researchers at ANY.RUN said in a report shared with GBhackers, have identified a coordinated infrastructure designed to mimic legitimate workflows while quietly enabling account compromise and system access.

Once a victim interacts with the invitation, the attack flow diverges. In credential theft scenarios, users are prompted to log in via familiar services.

Fake Invitation Phishing Campaign

The phishing pages capture email credentials through POST requests sent to endpoints such as /processmail.php, followed by OTP interception via /process.php.

In many cases, victims are intentionally shown an “Incorrect Password” message after the first attempt, increasing the likelihood of capturing accurate credentials on a second entry.

Google-specific phishing flows use spoofed authentication pages that transmit login data to attacker-controlled endpoints like /pass.php and /mlog.php before redirecting victims to legitimate Google services.

In parallel, other variants of the campaign deliver legitimate remote management tools including ScreenConnect, ITarian, Datto RMM, ConnectWise, and LogMeIn Rescue access.

These tools are often downloaded automatically or via a single-click prompt, allowing attackers to establish persistent remote access under the guise of trusted software.

Because these tools are widely used in enterprise environments, their presence may not immediately trigger alerts, increasing dwell time.

A key feature of the campaign is its reusable infrastructure, which provides defenders with identifiable patterns.

Phishing pages consistently load assets from paths such as /Image/*.png and trigger a predictable request sequence including /favicon.ico and /blocked.html.

This uniform behavior allows SOC teams to correlate activity across domains and identify related threats using threat intelligence queries.

The campaign disproportionately affects sectors such as education, banking, government, healthcare, and technology, where email access and remote administration are critical to daily operations.

For organizations in these industries, a single successful phishing attempt can lead to mailbox compromise, unauthorized access, or full remote control of endpoints.

Security experts warn that the biggest risk lies in delayed detection. Since each stage of the attack appears benign in isolation, traditional security controls may fail to identify the full threat chain early.

When the user selects Gmail as the login method, a different chain is observed. First, the user is redirected to a page disguised as a Google authorization form.

To mitigate these risks, organizations need earlier visibility into phishing activity, especially during the initial user interaction phase.

Tools like ANY.RUN’s interactive sandbox and threat intelligence platform enable analysts to safely analyze suspicious links, observe behavior in real time, and identify indicators such as credential submission endpoints or unauthorized downloads.

As phishing campaigns continue to evolve in sophistication and scale, this operation highlights the growing convergence of social engineering, credential abuse, and legitimate tool exploitation. Detecting and disrupting these blended threats early is critical to preventing full-scale compromise.

Indicators of Compromise

URL patterns: 

hxxps://<phish_site>/<url-pattern>/Image/office360.png 

hxxps://<phish_site>/<url-pattern>/Image/office.png 

hxxps://<phish_site>/<url-pattern>/Image/yahoo.png 

hxxps://<phish_site>/<url-pattern>/Image/google.png 

hxxps://<phish_site>/<url-pattern>/Image/aol.png 

hxxps://<phish_site>/<url-pattern>/Image/email.png 

hxxps://<phish_site>/blocked.html 

hxxps://<phish_site>/<url-pattern>/processmail.php 

hxxps://<phish_site>/<url-pattern>/process.php 

hxxps://<phish_site>/<url-pattern>/pass.php 

hxxps://<phish_site>/<url-pattern>/mlog.php 

hxxps://<phish_site>/<url-pattern>/check_telegram_updates.php 

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.