SeasonalInvite phishing: are your RMM controls keeping up?

TL;DR: SeasonalInvite phishing campaign has abused commercial RMM tools since at least January 2026, using seasonal lures, 959 eCard-themed domains, 2,658 TDS gate pages and AI-like landing-page code to deliver signed remote access software to Windows and macOS victims, according to Forescout. The real control gap is not link filtering alone but governed RMM usage, because legitimate installers can become attacker-run access paths.

Editorial analysis by NHI Mgmt Group, based on content published by Forescout: “SeasonalInvite: New Phishing Campaign Abuses eCards and RMM”.

By the numbers:

• The campaign used 959 eCard-themed domains to route victims toward phishing pages and payload delivery.
• The phishing pages contained 38 unique PHP files with the campaign fingerprint.

Key questions

Q: What fails when phishing is used to install legitimate RMM software?

A: The failure is not simply that a user clicked a bad link.

Q: Why do legitimate RMM tools increase the impact of phishing campaigns?

A: They increase impact because they convert a one-time execution event into remote administration capability.

Q: What are the signs that RMM abuse is already bypassing control boundaries?

A: Look for first-seen usage, multiple remote tools on the same endpoint, RMM execution from unusual paths, suspicious parent or child processes, and remote access that follows close on the heels of phishing or help desk impersonation.

Practitioner guidance

• Define an approved RMM inventory Maintain a current list of sanctioned remote management tools, tenant identifiers and expected enrollment destinations, then block or alert on anything outside that list.
• Alert on unsanctioned RMM enrollment Monitor for new ScreenConnect, LogMeIn Resolve, Kaseya or O&O Syspectr installations that connect to domains or tenants not owned by the organisation.
• Harden email and web filtering against seasonal lures Add detections for invitation-themed campaigns, poisoned search results and known download-page behaviours that use timed auto-downloads and double-click prompts.

Bottom line: SeasonalInvite turns seasonal phishing into a remote access problem by enrolling legitimate RMM tools into attacker-controlled infrastructure.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →