RSVP to Disaster: How One Click Installs a RAT

Summary

Cybercriminals are using phishing emails disguised as social event invitations to distribute malware. Victims are redirected through a fake RSVP button to a CAPTCHA verification page and then to a malicious download site. The attack ultimately installs a Remote Access Trojan (RAT), giving attackers extensive control over the compromised device.

Investigation

The Cofense Phishing Defense Center identified a campaign that relies on vague, curiosity-driven social engineering. Researchers uncovered a multi-stage infection flow that uses a CAPTCHA page hosted on a newly registered, unbranded domain to create a false sense of legitimacy. The final payload is a legitimate remote support application abused for malicious access.

Mitigation

Organizations should provide employee training focused on recognizing social engineering techniques involving vague, urgent, or curiosity-based email lures. Technical defenses should include email security gateways that block suspicious URLs and monitoring for unauthorized remote access tools. Endpoint protection should also flag legitimate software when it is executed in suspicious or unexpected contexts.

Response

When malicious activity is detected, immediately isolate the affected host from the network to prevent continued unauthorized access. Perform a comprehensive forensic investigation to determine the scope of compromise and identify potential data exfiltration. Reset affected user credentials and review system logs for unauthorized connections, persistence mechanisms, or other suspicious activity.

Simulation Execution

• Attack Narrative & Commands: The adversary initiates a spearphishing attack, sending an email with a link to a fake “Event Invitation.” Upon clicking, the user is prompted to download a file. In this simulation, we simulate the final stage where the user executes the downloaded ScreenConnect.ClientSetup.exe. The goal is to establish a remote access foothold. The execution of this specific filename will trigger the high-severity alert.

• Regression Test Script:

  # Simulation Script: Trigger ScreenConnect Detection
  # Note: We are creating a dummy file with the target name to simulate execution 
  # without actually installing potentially malicious software.
  
  $targetName = "ScreenConnect.ClientSetup.exe"
  $tempPath = Join-Path $env:TEMP $targetName
  
  Write-Host "[+] Creating dummy file: $tempPath"
  New-Item -Path $tempPath -ItemType File -Force
  
  Write-Host "[+] Simulating execution of $targetName..."
  # Using Start-Process to generate a Process Creation event (Event ID 1 / 4688)
  Start-Process -FilePath $tempPath -WindowStyle Hidden -ErrorAction SilentlyContinue
  
  Write-Host "[+] Simulation command complete. Check SIEM for alert."

• Cleanup Commands:

  # Cleanup Script
  $targetName = "ScreenConnect.ClientSetup.exe"
  $tempPath = Join-Path $env:TEMP $targetName
  
  if (Test-Path $tempPath) {
      Remove-Item -Path $tempPath -Force
      Write-Host "[+] Cleaned up dummy file: $tempPath"
  } else {
      Write-Host "[-] Dummy file not found. Nothing to clean."
  }