Fake conference invites: are your phishing controls layered enough?

TL;DR: Fake conference-invite phishing is becoming more polished, with Cisco Talos tracking a campaign that used trusted academic names, look-alike Google Forms pages and even swapped QR codes, while the sign-in relay made the login appear normal throughout, according to Adaptive Security. The lesson is that phishing defence now depends on layered control of identity verification, inbox protection and user behaviour, not on any single detection point.

Editorial analysis by NHI Mgmt Group, based on content published by Adaptive Security: “Fake Conference Invites Are Getting More Polished. Three Layers Keep Teams Ahead.”.

By the numbers:

• A 2025 UC San Diego study followed more than 19,500 health system employees across 10 phishing campaigns.
• Click rates in the UC San Diego study ranged from 1.82% for a fake Outlook password update to 30.8% for a fake vacation policy update.

Key questions

Q: How should security teams reduce the risk of fake event invitations leading to account compromise?

A: Use phishing-resistant authentication for high-risk users, enforce strong inbox filtering, and teach staff to verify the destination before they sign in.

Q: Why do lookalike domains still work against trained users?

A: Lookalike domains succeed because users often rely on visual familiarity and operational context, not perfect domain inspection.

Q: What are the signs that an invitation-based phishing campaign is becoming harder to spot?

A: Watch for trusted institutional names, highly specific event language, QR-code handoffs and pages that mirror a familiar cloud login or form.

Practitioner guidance

• Implement phishing-resistant sign-in for high-risk accounts Use passkeys or hardware security keys for executives, finance staff and administrators, and disable weak fallback methods where possible.
• Harden inbox controls against look-alike lures Tune email security to score behavioural anomalies, suspicious intent and domain mismatches, then remove confirmed threats from inboxes quickly.
• Require out-of-band verification for event invitations Tell staff to type the organiser address manually, verify QR-code destinations before sign-in and report suspicious messages through a named channel.

Bottom line: Fake conference invitations are effective because they blend social trust, QR-code delivery and a live credential relay that can make a malicious sign-in appear legitimate.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →