# RSVP to Disaster: Fake Event-Invitation Phishing Delivers ConnectWise ScreenConnect as RAT

> Cofense Phishing Defense Center reports a phishing campaign using 'You are cordially invited' event-invitation emails that route victims through a fake CAPTCHA and a fake invitation page to download a zip containing ScreenConnect.exe, giving attackers remote access via legitimate ConnectWise ScreenConnect software. The campaign targets a broad user base and no attribution is stated.

- **Published:** 2026-10-13T14:22:04Z
- **Last reviewed:** 2026-10-13T14:22:04Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3415
- **ID:** TL-2026-3415
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 11 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Cofense Phishing Defense Center (analyst Willmar Cheng, published 2026-10-13) describes a phishing campaign that abuses the legitimate remote support tool ConnectWise ScreenConnect as a remote access trojan (RAT). The lure is a deliberately vague event invitation: the subject reads 'You are cordially invited' and the body reads 'Join Us for a Special Gathering, Let Us Celebrate a Milestone', with no concrete event details, which lets the same message work across a diverse pool of recipients.

The victim clicks 'Click Here to Download the Invite' and is redirected to a fake CAPTCHA verification page hosted on a newly registered, unbranded domain (theinvitationestateco[.]vu). After passing the CAPTCHA, the victim reaches a second fake invitation page with an 'eInvite' button. The button forces the download of a zip archive named 'ViewDePartyyinvites' containing ScreenConnect.exe; the sampled installer is ScreenConnect.ClientSetup.exe (12,809,272 bytes). The reported infection URL is https://theinvitationestateco[.]vu/EdesktopInvite/ and the payload URL is https://theinvitationestateco[.]vu/EdesktopInvite/RsvpNow/invitedetails[.]php. The domain resolved to 104.21.73.121 and 172.67.162.73.

Once the victim runs the installer, the attacker has interactive remote access to the endpoint. The only visible indication is a taskbar icon, and the use of genuine, signed-looking remote-support software helps the payload avoid antivirus detection. Cofense does not state a sector focus, threat actor, or ScreenConnect relay/instance details. Related reporting shows the same abuse pattern in other lure themes: Cofense documented a Zoom-themed ScreenConnect chain in May 2026, and Abnormal documented Zoom and Microsoft Teams invitation lures in 2025 that reached over 900 organizations, where ScreenConnect access was used for follow-on lateral phishing and access resale. Those campaigns are not confirmed to be linked to this one. A BeaconBeagle lookup for 104.21.73.121 returned HTTP 404 (no record), so no C2 correlation was found. The IPs sit in Cloudflare address ranges and are likely fronting addresses, not origin infrastructure.

Defensive priorities are blocking the domain and URL paths, alerting on ScreenConnect installs that were not deployed by IT, and detecting zip/exe downloads that follow a CAPTCHA page.

## MITRE ATT&CK

- T1583.001 Domains
- T1566.002 Spearphishing Link
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1036.005 Match Legitimate Resource Name or Location
- T1684.001 Impersonation
- T1219 Remote Access Tools
- T1219.002 Remote Desktop Software

## Sources

- [RSVP to Disaster: How One Click Installs a RAT](https://cofense.com/blog/rsvp-to-disaster-how-one-click-installs-a-rat)
- [Click, Install, Compromised: The New Wave of Zoom-Themed Attacks](https://cofense.com/blog/click-install-compromised-the-new-wave-of-zoom-themed-attacks)
- [ScreenConnect Abuse Phishing Campaign (Abnormal)](https://abnormal.ai/blog/screenconnect-abuse-phishing-campaign)
- [Attackers Leverage Fake Zoom Invites to Deliver Remote Access Tool During Tax Season](https://abnormal.ai/attack-library/fake-zoom-invite-remote-access-tax-season)
- [Trusted Deception: Fake Microsoft Teams Invitation Leading to ScreenConnect](https://abnormal.ai/repo/abnormal-attacks/trusted-deception-fake-microsoft-teams-invitation-leading-to-screenconnect)
- [MITRE ATT&CK T1219 Remote Access Tools](https://attack.mitre.org/techniques/T1219/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3415