RSVP to Disaster: How One Click Installs a RAT

This campaign uses social engineering to deliver a remote access trojan by exploiting digital event invitations. Victims receive emails with generic subject lines about gatherings, containing download buttons that redirect through fake CAPTCHA pages hosted on recently created domains. After passing the CAPTCHA, victims download an eInvite file delivering a zipped folder with ScreenConnect.exe, a legitimate ConnectWise Screen Connect installer modified to function as a RAT. Once executed, attackers gain persistent remote access to the compromised system, evidenced by a taskbar icon showing an active connection. The attack leverages user trust and curiosity rather than technical sophistication, making it effective during times when event invitations are prevalent.

Successful execution of the weaponized ScreenConnect installer results in attackers gaining full remote access to the victim's device. This access allows adversaries to control the system remotely, potentially leading to data theft, system manipulation, or further network compromise. The campaign's reliance on social engineering increases the risk of user infection, particularly during holiday seasons when users are more likely to engage with event invitations.

No official patch or fix is applicable as this is a social engineering campaign leveraging a legitimate software installer. Mitigation should focus on user awareness training to recognize phishing emails and suspicious download prompts, especially those involving event invitations and CAPTCHA verifications from unknown domains. Organizations should consider restricting execution of unauthorized software installers and monitor for unusual ScreenConnect activity. Blocking access to the identified malicious domain (theinvitationestateco.vu) and associated URLs can also reduce exposure.