Anatomy of a Modern Kill Chain: Weaponized Event Invites and the Dual-Vector Threat Engine

If your security posture assumes phishing attacks still look like clumsy attachments and mangled Nigerian prince emails, you are operating on a model that is dead on arrival. The real danger today lives in the mundane, hyper-routine corporate workflows. Threat actors have realized that the easiest way into an enterprise subnet is not exploiting a zero-day in your edge router. It is weaponizing a social invitation that lands cleanly in your inbox, completely bypassing traditional perimeter defenses.

Modern campaigns deliberately step around obvious malware lures. Instead, they exploit legitimate business logic, commodity infrastructure, and standard corporate trust boundaries.

The Attack Topology: From Calendar Invite to Full Perimeter Breach

Analysis of this active campaign shows operations accelerating from late April 2026, targeting email credentials and provisioning unauthorized administrative access across key verticals. Education, Banking, Government, Technology, and Healthcare are absorbing the heaviest volume. These specific industries run on high email concurrency and extensive remote support tooling, making them vulnerable targets for operational disruption.

+--------------------------+
|  Weaponized Event Lure   |
|   (Sent via Amazon SES)  |
+-------------+------------+
              |
              v
+--------------------------+
|  Cloudflare CAPTCHA Gate | ---> [ Blocks Automated Sandboxes/Scanners ]
+-------------+------------+
              |
              +-----------------------------------+
              |                                   |
              v                                   v
+-----------------------------+     +-----------------------------+
|    Credential Harvesting    |     |     RMM Software Drops      |
|  - Fake Identity Providers  |     |  - ScreenConnect, Datto     |
|  - Pass-through to Google   |     |  - ITarian, ConnectWise     |
|  - Intercepts Passwords/OTP |     |  - LogMeIn Rescue           |
|  - Posts to /mlog.php       |     |  - Drive-by or User-click   |
+-----------------------------+     +-----------------------------+

The scale is driven by reusable toolkits and AI-assisted content generation, deploying infrastructure across dozens of domains. Within a five-day operational window, 160 suspicious links were indexed across roughly 80 phishing domains, heavily concentrated under .de ccTLDs registered starting in December 2025.

The Deceptive Kill Chain

The adversary executes a two-phase funnel that splits based on target capability and environment configuration.

Initial Invitation URL
       │
       ▼
Cloudflare CAPTCHA Check ──[Defeats Sandboxes]──► Routing Engine
                                                        │
         ┌──────────────────────────────────────────────┴─────────────────────────┐
         ▼                                                                        ▼
[Vector 1: Credential Interception]                     [Vector 2: RMM Deployment]
         │                                                                        │
         ├─► Google OAuth / Auth Flow                                            ├─► Automatic Drive-by Download
         │    └─► Legitimate Google Login                                        │    └─► Signed RMM Binary Drops
         │                                                                       │
         └─► Custom Identity Provider Lure                                       └─► Direct Manual Download CTA
              ├─► First Submission (Captured)                                         └─► Installs ScreenConnect / Datto /
              ├─► Forced "Incorrect Password" Error                                       ITarian / ConnectWise / LogMeIn
              ├─► Second Submission (Captured)
              ├─► OTP Interception (Forwarded)
              └─► Exfiltration Endpoint:
                  POST /pass.php
                  POST /mlog.php

Vector 1: Precision Credential Harvesting

The entry point routes the target through a Cloudflare CAPTCHA layer. This gate is deliberate: it shields the landing page from automated security crawlers and dynamic sandbox inspection.

Once cleared, the application presents a multi-tenant authentication gate:

Google Identity Flow: If the target selects Google, the framework passes them to the legitimate Google login interface, relying on backend handlers to trap context while maintaining visual authenticity.
Direct Enterprise Harvesting: If another provider is picked, the application intercepts the credentials directly. It captures the initial email and password submission, deliberately returns an "Incorrect Password" error, and forces a second entry. This deliberate validation error allows the attacker to log typos and capture high-confidence credentials.
OTP Interception: When the multi-factor authentication step triggers, the real-time proxy intercepts the one-time passcode (OTP) and streams it straight to attacker-controlled collector scripts, specifically POST /pass.php and POST /mlog.php.

Vector 2: Remote Monitoring and Management (RMM) Software Drops

In parallel tracks or fallback scenarios, the payload delivery switches to deploying legitimate Remote Monitoring and Management (RMM) clients. Attack vectors leverage:

Target Tools: ITarian, ScreenConnect, Datto RMM, ConnectWise, and LogMeIn Rescue.
Delivery Mechanism: Either an interactive download call-to-action or silent, automated drive-by downloads triggered upon rendering the page.

Because these installers are commercially signed, legitimate administration tools, endpoint detection and response (EDR) solutions frequently assign them high trust scores. They pass standard signature evaluations, giving adversaries persistent, out-of-the-box administrative access to the host machine.

Fingerprinting the Threat Infrastructure

Despite the use of automated toolkit builders, the threat infrastructure exhibits structural uniformity in its request-response pipeline.

Stage	Resource / Method	Operational Purpose
Gateway	`GET /`	Initial landing request to root
Validation	`GET /favicon.ico`	Asset hydration and browser environment profiling
Evasion	`GET /blocked.html`	Redirection sink for non-target user agents or crawlers
Rendering	`GET /Image/*.png`	Local retrieval of event-themed interface UI components
Exfiltration	`POST /pass.php`	Raw password interception capture endpoint
Exfiltration	`POST /mlog.php`	Main telemetry and multi-step OTP exfiltration endpoint

Security engineers can hunt this infrastructure before users interact with it by writing detection rules across web proxy logs and safe link analysis tooling to match these strict static request sequences.

Expanding Attack Vectors Across the 2026 Landscape

The weaponization of event invitations is part of a broader shift in initial access operations. Threat actors are running multiple parallel techniques designed to bypass perimeter gates:

QR Code Phishing (Quishing): Attackers embed target URLs within QR codes embedded in email bodies. This technique avoids text-based URL parsers entirely, shifting the interaction from a monitored workstation to an unmonitored mobile device.
CAPTCHA-Gated Phishing: Beyond Cloudflare, CAPTCHA gating is applied broadly to blind email sandbox detonation environments. Because automated crawlers fail the human interactive challenge, the backend never serves the malicious payload to the scanner.
Code-of-Conduct Lures: High-urgency administrative campaigns exploit corporate compliance themes. In one operation tracking across 26 countries and over 35,000 users (with 92% of the concentration inside the US), threat actors used enterprise-grade HTML templates to mimic mandatory policy sign-offs.
Phishing-as-a-Service (PhaaS) Platform Iteration: Platforms like Tycoon 2FA provide fast operational rotation, continuously swapping hosting providers and domain registration profiles to outpace static IP and domain reputation blacklists.
Amazon Simple Email Service (SES) Abuse: Threat actors route phishing campaigns through Amazon SES. Because the messages leverage authentic cloud infrastructure, they clear SPF, DKIM, and DMARC checks, delivering weaponized payloads right to the inbox.

Engineering Mitigations

Hardening the perimeter against multi-vector campaigns requires moving visibility up the kill chain:

Pre-Execution Link Analysis: Deploy safe link analysis engines capable of interrogating targets for the explicit structural pattern: root request followed by /favicon.ico, /blocked.html, and /Image/*.png.
Strict RMM Binary Controls: Standardize application whitelisting and software restriction policies. Unapproved installations of ScreenConnect, ITarian, Datto RMM, ConnectWise, and LogMeIn Rescue must be blocked by default on endpoints, regardless of valid code-signing certificates.
MFA Protocol Hardening: Enforce phishing-resistant multi-factor authentication everywhere possible to neutralize middleman extraction scripts like /mlog.php. Real-time OTP interception relies on legacy protocols that trust relay endpoints.

Staying ahead of modern phishing infrastructure requires dismantling the mechanics of the toolkit itself. Treat every invitation, administrative policy alert, and dynamic redirect as an unverified execution path inside your network.