A new phishing campaign is targeting users by spoofing legitimate invitation services. Hackers are sending fake invitations that appear to come from Paperless Post, Evite, and Punchbowl, three of the most popular digital invitation platforms.
The scam works by mimicking the look and feel of real invitations from these services. When recipients click on what looks like a legitimate party or event invite, they're actually opening the door for malware or giving attackers access to their systems.
This matters because these platforms are commonly used for both personal and professional events. Your guard might be down when you see what looks like a wedding invite or corporate event announcement, making these attacks particularly effective.
The timing is notable as we head into spring and summer event season, when invitation volume naturally increases. Attackers are banking on that familiarity and the social pressure to respond to invitations quickly.
Before clicking any invitation link, verify the sender through a separate channel. Check the actual email address, not just the display name. And if you're using AI tools to manage your inbox or calendar, make sure they're not auto-accepting or processing these malicious invites without human review.
