Briefing
Cofense reported on October 13, 2026 a phishing campaign using vague invitation emails with subjects such as "You are cordially invited." The link opens a fake invitation page, then a CAPTCHA page, then a second invitation page whose only real action is downloading a zip file. Inside is ScreenConnect.exe, a legitimate ConnectWise ScreenConnect installer that gives the attacker remote control of the computer.
Two details make this effective. The CAPTCHA step makes the page feel legitimate, and the payload is a genuine, signed product that security tools may allow. The invitation itself has no date, venue or host name, which is the clearest warning sign for staff.
What to do
- Brief staff: real invitations name a host, a date and a place. An invitation that requires downloading a file is not an invitation.
- Tell staff that a CAPTCHA does not mean a site is safe.
- Restrict remote support software to the one tool your IT provider uses, and block the rest with application control.
- Remove local administrator rights from everyday accounts.
- Give staff a single, simple way to report suspicious email.
How to verify
- Query your software inventory for ScreenConnect and other remote access tools and confirm each one is expected.
- Check endpoint logs for zip files downloaded from unfamiliar domains followed by a new remote access service.
- Send a simulated invitation phish and measure how many staff report it.
Sources
- Cofense, RSVP to Disaster: How One Click Installs a RAT, Oct 13, 2026
- CISA, Require Multifactor Authentication
- CISA, Cybersecurity Performance Goals 2.0
Want help putting this in place? Contact Computer Plus.