A new phishing campaign is tricking people with fake party invitations that secretly install remote access software on Windows computers.

The attack uses social engineering to deliver ScreenConnect, a legitimate remote support tool, allowing threat actors to gain complete control of victim systems.

What appears to be a harmless invitation from a friend turns into a serious security breach that gives attackers unrestricted access to personal files, credentials, and sensitive data.

The campaign begins with emails designed to look like casual party invitations from trusted contacts.

These messages often come from compromised email accounts, making them appear authentic and familiar.

The informal tone and social context lower suspicion, encouraging recipients to click without hesitation.

Malwarebytes researchers identified this campaign primarily targeting users in the United Kingdom, though there are no technical barriers preventing its expansion to other regions.

When victims click the link in the email, they land on a carefully crafted webpage that mimics a genuine event invitation.

The page displays a bold headline reading “You’re Invited!” along with messages suggesting a friend sent the invitation and that it should be viewed on a Windows device.

A countdown timer creates urgency by indicating the invitation is already downloading, while social proof statements like “I opened mine and it was so easy!” push users toward executing the file.

Within seconds, the browser automatically downloads a file named RSVPPartyInvitationCard.msi.

The downloaded MSI file is not an invitation at all but an installer that launches Windows Installer (msiexec.exe) to silently deploy ScreenConnect Client on the victim’s computer.

Malwarebytes analysts noted that the installation happens without clear user-facing notifications, making it difficult for victims to realize what is occurring.

The process installs ScreenConnect binaries under C:\Program Files (x86)\ScreenConnect Client\ and creates a persistent Windows service with randomized characters in its name, such as ScreenConnect Client 18d1648b87bb3023.

How the Remote Access Tool Establishes Control

Once ScreenConnect is installed, it initiates encrypted HTTPS connections to ScreenConnect relay servers using a uniquely assigned instance domain.

This connection grants attackers the same capabilities as a remote IT technician, including viewing the victim’s screen in real time, controlling the mouse and keyboard, uploading or downloading files, and maintaining access even after system restarts.

Since ScreenConnect is legitimate software commonly used for remote support, traditional security tools may not flag it as malicious.

The first signs of compromise often appear as behavioral anomalies, such as unexplained cursor movements, windows opening without user input, or unfamiliar processes running in the background that victims do not remember installing.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Beware of Malicious Party Invitations that Tricks Users into Installing Remote Access Tools appeared first on Cyber Security News.

The Ricochet Chollima advanced persistent threat group has launched a targeted campaign against activists and organizations focused on North Korea, beginning in March 2025.

The operation, named “Operation: ToyBox Story” by Genians Security Center, relies on a clever combination of social engineering and malware delivery tactics.

Attackers send spear-phishing emails that appear to come from credible sources, specifically impersonating North Korea-focused security experts.

These emails contain Dropbox links that lead to compressed archives holding malicious Windows shortcut files. The victims unknowingly download files that trigger hidden code execution when opened.

The attack demonstrates significant sophistication in disguising malicious content. Threat actors crafted emails with subject lines referencing North Korean troops deployed to Russia, using culturally relevant content to increase the likelihood of user engagement.

The email attachments mimic Hangul document icons—commonly associated with legitimate Korean word processors—to deceive recipients into thinking they are opening standard documents rather than executable files.

This social engineering approach proves effective because users trust familiar file icons and organizations they believe are sending the messages.

An Offensive Security Engineer, S3N4T0R, noted the malware after analyzing the campaign’s technical characteristics and infection chain.

S3N4T0R identified how the attack progresses through multiple stages, each designed to evade security tools and maintain persistence on compromised systems.

The analysis revealed that attackers deliberately structured the malware to stay hidden in system memory rather than writing files to disk.

Fileless Execution Through Memory Injection

The most dangerous aspect of this malware involves its ability to execute code without leaving traces on the hard drive.

When victims extract the ZIP archive and open the seemingly innocent document file, a hidden PowerShell command embedded within the shortcut executes silently.

This command launches a batch file named “toy03.bat,” which then loads a file called “toy02.dat” from the temporary folder.

The loader decodes XOR-transformed data and injects shellcode directly into memory, bypassing traditional file-based detection methods.

Once loaded into memory, the malware creates a new executable thread to run the injected code.

This technique, known as fileless malware execution, presents serious challenges for security teams because the malicious program leaves minimal evidence on disk.

The malware then establishes communication through Dropbox API channels, allowing attackers to send commands and receive stolen data while hiding their activities within legitimate cloud service traffic.

This approach represents a significant evolution in APT tactics, leveraging trusted services to conceal malicious operations and making detection substantially more difficult for defenders.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Chollima APT Hackers Weaponize LNK File to Deploy Sophisticated Malware appeared first on Cyber Security News.