SeasonalInvite Phishing Campaign Abuses Legitimate RMM Tools for Persistent Access

Forescout disclosed SeasonalInvite, a phishing campaign that uses fake seasonal eCard invitations to trick Windows and macOS users into installing legitimate remote monitoring and management (RMM) software, giving attackers persistent remote access without deploying traditional malware. Active since at least January 2026, the operation uses themed lures tied to events such as tax season, Valentine’s Day, and Easter, then routes victims through a traffic distribution system to counterfeit eCard pages that deliver installers tailored to the target operating system.

Researchers said the attackers abused commercially signed tools including ConnectWise ScreenConnect, LogMeIn Resolve, Kaseya, and O&O Syspectr, helping the activity blend in with trusted software and evade standard trust checks. On macOS, the campaign reportedly paired a signed Kaseya package with a separate configuration file that redirected enrollment to attacker-controlled infrastructure through an unattended deployment feature. Forescout also identified a broad support infrastructure of 959 eCard-themed domains and 2,658 traffic distribution gate pages, along with evidence that parts of the phishing kit and web pages were likely AI-generated.