SeasonalInvite: The RMM Trap in eCards
A sophisticated six-month phishing campaign is exploiting legitimate RMM software via fake greeting cards to compromise systems.
Cybercriminals are increasingly turning to a clever ruse that blends the mundane with the malicious, leveraging the familiarity of electronic greeting cards to compromise both Windows and macOS endpoints. This operation, identified as SeasonalInvite, demonstrates a high degree of adaptability by aligning its lures with calendar-driven events, ranging from seasonal holidays to tax-related deadlines.
Weaponizing Legitimate Remote Management
The core of the SeasonalInvite strategy relies on the deployment of genuine remote monitoring and management (RMM) software. By utilizing legitimate, commercially signed tools, the attackers successfully bypass traditional security filters that typically detect unauthorized malware signatures. The campaign has been observed utilizing four primary products: ConnectWise ScreenConnect, LogMeIn Resolve, Kaseya, and the German-developed O&O Syspectr.
The delivery mechanism is designed to feel authentic, directing victims to a site that mimics the well-known service BlueMountain. Upon arrival, users are presented with a loading animation, after which an OS-specific installer is triggered. On Windows systems, the attack utilizes batch and VBScript droppers to force a User Account Control prompt, effectively tricking the user into granting the necessary administrative privileges. Meanwhile, macOS versions of the campaign leverage a Kaseya package paired with a configuration file that redirects enrollment to an attacker-controlled server, specifically exploiting features originally intended for unattended deployment.
AI-Assisted Development Tactics
The investigation suggests that the operators behind SeasonalInvite have integrated large language models into their workflow to streamline the production of phishing infrastructure. The landing pages feature telltale signs of AI-generated code, including specific emoji-prefixed task comments and explicit references to stitching together various code snippets. This automation likely allows the threat actors to lower the costs associated with generating new variants of their phishing kits.
- 959 domains identified as part of the phishing and search-poisoning operation.
- 3 seconds is the duration of the loading animation before the malicious download triggers.
- 2658 URLs associated with the traffic distribution system's gate-page fingerprint.
Forescout assessed the operator likely used a large language model (LLM) to stitch pieces of code into a single landing page with operating-system detection, Telegram-based reporting and animation logic, lowering the cost of producing fresh variants.
— Forescout, in their new research detailing the campaign.
Implications for Enterprise Security
For organizations, the SeasonalInvite campaign underscores the peril of allowing unapproved RMM tools within the corporate environment. Because these tools are inherently designed to provide administrative control, their presence—even when legitimately signed—poses a significant risk if deployed by unauthorized parties. Security teams are urged to maintain a strictly vetted inventory of remote support software and implement network alerts for any activity stemming from unapproved utilities. Furthermore, the reliance on social engineering through seasonal themes serves as a stark reminder that users must remain vigilant against unsolicited invitations, especially those requesting software installations or elevated permissions.
