That Party RSVP Installs ScreenConnect, Not Confetti

Cofense’s Phishing Defense Center intercepted a holiday-season classic with worse catering: a vague “you are cordially invited” email whose download button does not open a calendar. It walks you through a fake CAPTCHA, a second fake invite page, and a zip that drops ScreenConnect.ClientSetup.exe. Legitimate ConnectWise remote support software, abused as a remote access trojan. Your taskbar gets a quiet little icon. The attacker gets a live channel into the box. RSVP stands for “Remote Shell, Very Persistent.”

The OTX pulse “RSVP to Disaster: How One Click Installs a RAT” recirculated the Cofense write-up on October 14. The underlying Cofense post is dated October 13, 2026. Timing matters because holiday invite bait scales. Vague subjects blast cleanly across thousands of inboxes without naming a bride, a venue, or a single verifiable detail. Curiosity does the rest. Security awareness training that only shows fake Microsoft 365 login pages is about to look adorable.

The lure, step by step

1. Email: Subject lines like “You are cordially invited” and body copy about a “special gathering” or “milestone” with no organizer, date, or address. Button text: “Click Here to Download the Invite.”
2. Forced download / redirect: Lands on a CAPTCHA hosted on a generic, unbranded domain Cofense flagged as less than a month old.
3. Second fake invite page: Still no venue or time. The only useful UI is an “eInvite” button.
4. Payload: Zip folder labeled along the lines of ViewDePartyyinvites containing ScreenConnect.exe / ScreenConnect.ClientSetup.exe.
5. Execution: Installs ConnectWise ScreenConnect. A small taskbar icon and chat/connection UI appear. That is the RAT session, not party planning software.

Cofense’s point about SEGs is uncomfortable: these campaigns still show up in environments that already paid for a Secure Email Gateway. The attachment or URL path is socially engineered enough that “we have a SEG” is not a personality.

IOCs from Cofense (treat as campaign-specific)

• Infection URL pattern: hxxps://theinvitationestateco[.]vu/EdesktopInvite/
• Payload URL pattern: hxxps://theinvitationestateco[.]vu/EdesktopInvite/RsvpNow/invitedetails.php
• Infrastructure IPs observed: 104.21.73.121, 172.67.162.73 (Cloudflare edge in many campaigns; correlate, do not worship)
• File: ScreenConnect.ClientSetup.exe
• MD5: 739a54032b89432bb4c9c33969f6b383
• SHA-256: f3aab811ae8163e09db40db201facc7e189d1a1b161be265202ca54b39b5e6cc
• Size: 12,809,272 bytes

Hash-based blocking helps for this exact binary. It does not save you from the next ScreenConnect build the operators sign up for with a fresh tenant. Detect the behavior: unexpected ScreenConnect installs on endpoints that are not helpdesk jump boxes.

Why abusing real RMM is the joke that keeps winning

Antivirus that blesses signed remote-support clients will shrug while your intern installs a backdoor because a webpage said “eInvite.” Microsoft and multiple state/provincial advisories have spent 2025 and 2026 yelling about phishing that delivers legitimate RMM tools (ScreenConnect, and cousins) for persistent access. The malware is the business process. The binary is a customer of ConnectWise until someone notices the tenant.

Related public guidance from NJCCIC and earlier Malwarebytes reporting describes the same family of fake invitation / RSVP lures dropping ScreenConnect MSI or ClientSetup binaries and leaving a persistent service. Different campaigns, same punchline.

What defenders should do (not vibes)

1. Block and hunt the campaign IOCs above in email, proxy, and EDR. Expire them as infrastructure rotates.
2. Application control: only allow ScreenConnect / other RMM from IT-managed packages and known tenant IDs. User-initiated ClientSetup from a Downloads zip should hard-fail.
3. EDR analytics: alert on ScreenConnect service creation outside change windows; parent process chains from browsers or explorer.exe unpacking party zips.
4. Email rules: quarantine inbound messages with “cordially invited” / RSVP language plus generic download buttons when the sending domain fails DMARC or is brand-new.
5. User reporting: make the “report phishing” button faster than the “download invite” button. Cofense’s whole pitch is that humans still catch what gateways miss. Annoying, but true.

Helpdesk script that does not insult people

Real invites come from people you know, on domains you can call, with dates and addresses that exist. Corporate events go through IT-approved calendar tools. Nobody legitimate needs you to defeat a CAPTCHA on a three-week-old .vu domain to see a PDF of a dinner. If the invite is real, the host can resend through the normal channel after you ask one boring question.

Sloth take

We spent a decade telling users not to open sketchy EXE files from strangers. Attackers answered by wrapping a trusted remote-support installer in wedding language and a CAPTCHA. The industry will sell you another awareness video. Meanwhile some SOC is staring at a ScreenConnect session named like a party planner and wondering why the C2 looks like tech support. Allow-list your RMM. Hunt unexpected tenants. And maybe stop RSVPing to ghosts.

Phishing-resistant design and boring incident response are available as a service. Book Dark Edge Consulting.

Email authentication still matters (even when the bait is social)

DMARC/DKIM/SPF will not stop a campaign sent from an attacker-owned domain that looks vaguely festive. They will stop easy spoofs of your CEO’s real domain inviting the company to a “milestone.” Enforce rejection on your own domains. For inbound, weight brand-new domains with invitation language and forced-download buttons as high risk regardless of authentication pass on the attacker’s domain. Passing DMARC on theinvitationestateco.vu only proves the criminal controls that domain.

Endpoint telemetry queries worth keeping

• Process creation: ScreenConnect.ClientSetup.exe or MSI installs where parent is a browser, Outlook.exe, or a user unpacker
• Service install: ScreenConnect services on workstations outside the IT RMM collection
• Network: new connections to ScreenConnect relay infrastructure from endpoints that never had helpdesk sessions
• File: zip extractions under user Downloads with names matching invite/RSVP/party patterns followed by EXE execution within N minutes

Tune to your EDR’s schema. The idea is behavioral: unexpected remote-support tooling on endpoints that are not break-glass support boxes.

Awareness that is not a cartoon

Show this kill chain in training: vague invite, CAPTCHA on a baby domain, second page still vague, zip, signed remote tool, tray icon. Ask staff which step felt “safe” because it looked like a webpage. That is the lesson. Do not shame people for curiosity. Shame the process that allows ClientSetup to run from Downloads without a ticket.

Executives get targeted with nicer HTML. Same rules. Especially around holiday parties, retirement events, and “surprise gatherings” that somehow need an EXE.

ThreatFox / intel adjacency

ThreatFox and peers will light up with unrelated stealer C2s on any given day (Vidar had a loud day in our Oct 14 to 15 pull). Do not conflate those feeds with this RSVP campaign. Use Cofense’s hashes and URLs for this story, and keep RMM-abuse detections generic so the next tenant ID does not require a new blog post to catch.

Sources

• Cofense, “RSVP to Disaster: How One Click Installs a RAT” (Oct 13, 2026)
• AlienVault OTX pulse recirculation (modified Oct 14, 2026)
• NJCCIC and Malwarebytes public advisories on fake invitation / ScreenConnect abuse (campaign family context)