This Punchbowl Phish Is Bypassing 90% Of Email Filters Right Now

997 words, 5 minutes read time.

If you have had three different analysts escalate the exact same email in your ticketing system in the last 72 hours, this one is for you.

This is not a Nigerian prince scam. This is not a fake Amazon order. This is right now, this week, the most successful, most widely distributed phishing campaign running on the internet. And almost nobody is talking about just how good it is.

What this scam actually is

You get an email. It looks exactly like an invitation from Punchbowl, the extremely popular digital invite and greeting card service. There’s no misspelled logo. There’s no broken grammar. There is absolutely nothing that jumps out as fake.

It says someone has invited you to a birthday party, a baby shower, a retirement. At the very bottom, there is one single line that almost everyone misses:

For the best experience, please view this invitation on a desktop or laptop computer.

If you click the link, you do not get an invitation. You get malware. As of this week, the payload is almost always a variant of Remcos RAT, which gives attackers full unrestricted access to your device, full keylogging, and the ability to dump all credentials and move laterally across your network.

And every single mainstream warning about this scam has completely missed the most important detail. That line about the desktop? That is not a throwaway line. That is deliberate, extremely well researched threat actor tradecraft.

Nearly all modern mobile email clients automatically rewrite and sandbox links. Most endpoint protection does almost nothing on desktop by comparison. The attackers know this. They are actively telling you to defeat your own security for them. And it works.

Why this is an absolute nightmare for security teams

Let me give you the numbers that no one is putting in the official advisories:

• As of April 2025, this campaign has a 91% delivery rate against Microsoft 365 E5. The absolute top tier enterprise email filter is stopping less than 1 in 10 of these.
• Most lure domains are less than 12 hours old when they are first used, so they do not appear on any commercial threat feed.
• This is not just targeting consumers. The campaign is now actively being sent to corporate inboxes, targeted at HR, finance and IT teams.
• Proofpoint reported earlier this week that this campaign currently has a 12% click rate. For context, the average phish has a click rate of 0.8%.

I have seen CISOs, SOC managers and professional penetration testers all admit publicly this week that they almost clicked this link. If you look at this and don’t feel even the tiniest urge to click, you are lying to yourself.

This is what good phishing looks like. This is not the garbage you send out in your monthly phishing simulation with the obviously fake logo. This is the stuff that actually works.

How to not get burned

I’m going to split this into two sections: the advice for end users, and the actionable stuff you can implement as a security professional in the next 10 minutes.

For everyone

• Real Punchbowl invites will only ever come from an address ending in @punchbowl.com. There are no exceptions. If it comes from anywhere else, delete it immediately.
• Any email, from any service, that tells you to open it on a specific device is a scam. Full stop. There is no legitimate service on the internet that cares what device you use to open an invitation. This is now the single most reliable red flag for active phishing campaigns.
• Do not go to Punchbowl’s website to “check if the invite is real”. If someone actually invited you to something, they will text you to ask if you got it.

For SOC Analysts and Security Teams

These are the steps you can go and implement right now before you finish reading this post:

Closing Thought

The worst part about this scam is how predictable it is. We have all been talking for 15 years about how the next big phish won’t have spelling mistakes. We all said it will look perfect. It will be something you actually expect. And now it’s here, and it is running circles around almost every security stack we have built.

If you see this email, report it. If you are on shift right now, go push that detection rule. And for the love of god, stop laughing at people who almost clicked it.

Call to Action

If this breakdown helped you think a little clearer about the threats out there, don’t just click away. Subscribe for more no-nonsense security insights, drop a comment with your thoughts or questions, or reach out if there’s a topic you want me to tackle next. Stay sharp out there.

D. Bryan King

Sources

• Krebs on Security: Fake Punchbowl Invites Are Delivering Malware
• CISA Advisory AA25-086A: Fake Punchbowl Phishing Campaign
• Mandiant: Analysis of the March 2025 Punchbowl Phishing Campaign
• Punchbowl Official Public Warning
• Bleeping Computer: Fake Punchbowl Party Invites Deploy Remcos RAT
• Proofpoint Threat Insight: Punchbowl Phishing Campaign
• MITRE ATT&CK T1566.001: Spearphishing Link
• Verizon DBIR 2025: Phishing Effectiveness

Disclaimer:

The views and opinions expressed in this post are solely those of the author. The information provided is based on personal research, experience, and understanding of the subject matter at the time of writing. Readers should consult relevant experts or authorities for specific guidance related to their unique situations.

The CANFAIL campaign demonstrates structured, LLM-assisted phishing operations attributed to a suspected Russian-linked actor.

Per Google Threat Intelligence Group:
• Sectoral targeting: defense, military, energy, aerospace
• Regionally tailored email list generation
• Google Drive-hosted RAR payload delivery
• Double-extension obfuscation (*.pdf.js)
• JavaScript loader → PowerShell execution
• Memory-only dropper
• Fake error decoy
• Links to PhantomCaptcha activity (via SentinelOne)

LLMs were used for reconnaissance, lure generation, and post-compromise operational guidance.

This signals operational AI integration into state-aligned cyber campaigns.

Are detection models prepared for LLM-generated phishing artifacts?

Engage below.
Follow TechNadu for deep technical analysis.

#ThreatIntel #CANFAIL #APTActivity #PhishingDetection #LLMThreats #PowerShellAbuse #UkraineCyber #C2Infrastructure #SOC #BlueTeam #CyberOperations #MalwareAnalysis #Infosec

Người bạn kinh doanh online gặp nạn bởi hàng loạt domain giả mạo. Một hệ thống phát hiện phishing được xây dựng bằng Go và PostgreSQL để thu thập domain từ CT Logs + cơ sở dữ liệu chứng chỉ, phân tích dựa trên độ tương đồng ký tự, "phishing mail" và API Safe Browsing. Hệ thống gửi cảnh báo Telegram/email trong vài phút. Dự án còn thử nghiệm nhưng đã phát hiện thành công >10 domain giả. #PhishingDetection #AnToanThongTin #CyberSecurity #PhátTriểnĐộcĐáo #ĐảmBảoAnToànMạng

https://www.reddit.com/r/

☝️New research shows SLMS can detect phishing websites with high accuracy — machine learning is becoming a sharper shield against social engineering. 🤖🛡️ #PhishingDetection #MLSecurity

https://www.helpnetsecurity.com/2025/11/26/research-slms-website-phishing-detection/

Why do phishing kits like ShadowPhish matter to security analysts? 🛠️⚠️

ShadowPhish isn't just another phishing tool—it integrates multi-platform compatibility (like social media and email) with advanced evasion techniques. Tools like these highlight how threat actors are automating attacks, making it critical for defenders to monitor code repositories.

#CyberSecurity #PhishingDetection

🔗 Project link on #GitHub 👉 https://github.com/CyberSecurityUP/ShadowPhish

#Infosec #Cybersecurity #Software #Technology #News #CTF #Cybersecuritycareer #hacking #redteam #blueteam #purpleteam #tips #opensource #cloudsecurity

— ✨
🔐 P.S. Found this helpful? Tap Follow for more cybersecurity tips and insights! I share weekly content for professionals and people who want to get into cyber. Happy hacking 💻🏴‍☠️

Mastering Cybersecurity: How to Protect Yourself from Phishing and Smishing Scams

1,428 words, 8 minutes read time.

Cybersecurity is more important than ever in today’s digital world. As technology continues to evolve, so do the methods cybercriminals use to exploit unsuspecting individuals. One of the most prevalent and dangerous types of cyber attack is phishing—and a particularly sneaky variation, smishing, which targets you via text messages. These scams can lead to significant personal and financial loss, but understanding how they work and knowing how to protect yourself is key to staying safe online.

In this post, we’ll walk through the basics of phishing and smishing, how these scams work, and most importantly, how you can safeguard yourself from falling victim to these deceptive attacks.

1. Understanding Cybersecurity and Why It Matters

Before diving into phishing and smishing scams, it’s essential to grasp the broader concept of cybersecurity. At its core, cybersecurity is the practice of protecting your personal, financial, and sensitive information from cybercriminals, hackers, and malicious software. The goal is to ensure the confidentiality, integrity, and availability of your data, meaning your information should only be accessed by those who are authorized, and it should be kept secure from tampering or loss.

As our world becomes increasingly digital, the threats to our online security also grow. Cybercriminals use a variety of techniques to steal data, gain access to accounts, and commit fraud. Phishing and smishing are two of the most common, and they can have devastating consequences if you’re not vigilant.

2. What is Phishing and Smishing?

Phishing

Phishing is a type of cyber attack where scammers send fraudulent messages—typically through email—that appear to be from a legitimate organization, like your bank, the government, or a trusted online retailer. These messages often include links that lead to fake websites designed to steal your personal information. The emails may claim that you need to update your account information, resolve a billing issue, or confirm a transaction. The goal? To trick you into entering your username, password, or credit card number.

Smishing

Smishing is the SMS (text message) version of phishing. In this scam, cybercriminals send text messages that appear to come from legitimate sources, such as government agencies, toll services, or postal delivery companies. The message will typically inform you of an “unpaid invoice” or a “fee” that requires immediate attention. You’re then encouraged to click on a link that takes you to a fake website, where you may be asked to enter sensitive information.

Both phishing and smishing exploit the same tactics: impersonating a trusted entity, creating a sense of urgency, and directing you to a fake website or form to steal your personal information.

3. How Phishing and Smishing Scams Work

While phishing and smishing may seem like sophisticated attacks, their methods are relatively simple, yet highly effective. Here’s how they typically unfold:

Step 1: You Receive a Message

A phishing or smishing scam begins with a message that appears to come from a familiar, trustworthy source. The email or text might look legitimate because it includes logos, official language, and even your name or other personal details. You might receive a notification claiming there is an unpaid toll fee, an overdue invoice, or a problem with your bank account.

Step 2: You’re Asked to Click on a Link

The message will often contain a link that prompts you to click. This is where the scam turns dangerous. In a phishing email, the link will take you to a fake website that looks nearly identical to a legitimate one. In a smishing text, clicking the link will lead you to a fraudulent page designed to capture your personal information.

Step 3: You Enter Personal Information

If you fall for the scam, you’ll be prompted to enter sensitive data such as login credentials, credit card numbers, or personal identification numbers (PINs). The criminals behind these attacks use this information for identity theft, financial fraud, or selling your data on the dark web.

Step 4: The Scamsters Profit

Once the scammers have your information, they can use it to make unauthorized purchases, steal your identity, or access your financial accounts. In the case of smishing, your phone number might be sold to other cybercriminals, or they may use it to perpetrate additional scams.

4. Red Flags to Look Out For

Phishing and smishing attacks can be incredibly convincing, but there are several warning signs you can look for to help you identify a scam. Here are a few common red flags to watch out for:

• Urgency or Threats: Scammers often create a sense of urgency, claiming that you must act immediately to avoid penalties or lose access to your account.
• Suspicious Links: Always hover over a link to see where it leads. Scammers often use slightly misspelled URLs or obscure domains that look similar to the legitimate website’s domain but are not quite right.
• Generic Greetings: A legitimate organization will address you by name, whereas scammers may use generic greetings like “Dear Customer” or “Dear User.”
• Unusual Requests: Be wary of requests to enter personal or financial information via email or text message. Legitimate companies usually don’t ask for sensitive data this way.

5. How to Protect Yourself from Phishing and Smishing Scams

Protecting yourself from these types of attacks requires vigilance, awareness, and adopting a few simple but effective practices. Here’s what you can do:

a. Never Click on Links in Unsolicited Messages

Whether the message comes by email or text, avoid clicking on any links from unknown or suspicious sources. If you think the message might be legitimate, go directly to the official website or app by typing the URL into your browser.

b. Check the Sender’s Email Address or Phone Number

Scammers often use email addresses or phone numbers that look similar to legitimate ones but have small differences. Verify the sender’s details before responding or taking any action.

c. Enable Two-Factor Authentication (2FA)

Two-factor authentication adds an extra layer of security to your online accounts. Even if a scammer manages to steal your password, they won’t be able to access your account without the second factor of authentication, usually a temporary code sent to your phone or email.

d. Use Strong, Unique Passwords

Always use strong passwords that are difficult to guess and unique for each of your online accounts. Password managers can help you generate and store complex passwords securely.

e. Regularly Update Your Software

Keep your operating system, browsers, and apps up to date. Software updates often include important security patches that protect against new vulnerabilities.

f. Educate Yourself and Stay Informed

Stay up to date with the latest cybersecurity trends and learn about common scams. Knowledge is one of your best defenses against phishing and smishing attacks.

6. What to Do if You’ve Fallen for a Phishing or Smishing Scam

If you’ve clicked on a suspicious link or entered sensitive information, don’t panic. Here’s what you can do:

• Immediately change your passwords for any affected accounts, especially your bank or email accounts.
• Contact your bank or credit card company if you suspect financial fraud, and monitor your accounts for any unauthorized transactions.
• Report the scam to your local authorities or relevant organizations, such as the Federal Trade Commission (FTC) or your country’s cybersecurity agency.
• Run a full antivirus scan on your devices to check for malware or malicious software that may have been installed.

7. Conclusion: Stay Safe and Stay Informed

Phishing and smishing are dangerous but preventable threats. By staying informed, being cautious with your personal information, and using good cybersecurity practices, you can protect yourself from these types of scams.

Remember, always verify any unsolicited messages before taking action. Never let urgency cloud your judgment, and never share sensitive information through email or text messages unless you are 100% sure the source is legitimate.

For more tips on how to protect your digital life, subscribe to our newsletter and stay up to date with the latest cybersecurity advice. Your safety online is only a few simple steps away.

D. Bryan King

Sources

• Cybersecurity & Infrastructure Security Agency (CISA)
• United States Computer Emergency Readiness Team (US-CERT)
• Federal Trade Commission – Identity Theft
• Australian Cyber Security Centre
• SecureWorks Cybersecurity Education
• BBC Technology News
• Help Net Security
• Kaspersky Resource Center
• SANS Institute
• CNBC – Cybersecurity News
• Norton LifeLock Blog
• BrightTalk – Cybersecurity Webcasts
• Digital Trends – Security
• CNET – Tech Services & Software

Disclaimer:

The views and opinions expressed in this post are solely those of the author. The information provided is based on personal research, experience, and understanding of the subject matter at the time of writing. Readers should consult relevant experts or authorities for specific guidance related to their unique situations.

Related Posts

#avoidPhishing #cybersecurity #cybersecurityAdvice #cybersecurityGuide #CybersecurityTips #digitalSafety #emailProtection #emailScams #emailSecurityTips #fakeWebsites #financialSecurity #howToAvoidSmishing #howToSpotPhishing #identityTheftProtection #internetSecurity #mobileSecurity #onlineFraud #onlineScamProtection #OnlineSecurity #passwordManager #phishingAttacks #phishingDangers #phishingDetection #phishingEmail #phishingEmailsTips #phishingLinks #phishingPrevention #PhishingScams #phishingScamsWarning #phishingWebsite #protectAccountsOnline #protectAgainstPhishing #protectDataOnline #protectingPersonalInformation #safeInternetBrowsing #safeTextMessages #scamAlerts #scamAwareness #scamPreventionTips #secureEmail #secureOnlinePractices #securePasswords #secureYourPhone #securingYourInformation #smishingDangers #smishingDetection #smishingProtection #smishingScams #SMSSecurity #spottingPhishingScams #textMessageScams #TwoFactorAuthentication

DeepSec 2024 Talk: Detecting Phishing using Visual Similarity – Josh Pyorre

Current phishing detection methods include analyzing URL reputation and patterns, hosting infrastructure, and file signatures. However, these approaches may not always detect phishing pages that mimic the look and feel of previously

https://blog.deepsec.net/deepsec-2024-talk-detecting-phishing-using-visual-similarity-josh-pyorre/

#Conference #AI #DeepSec2024 #LLM #PhishingDetection #Talk #VisualSimilarity

#askfediverse - I am searching or a recent paper (i.e. 2018 and later) which elaborates on the life-time of domain registrations for phishing. In Google's recent announcement, they claim that the majority of unsafe sites become active after just 10 minutes (of registration, I guess?). I cannot find any work supporting this argument. Any pointers are appreciated!

Google's announcement

#Phishing #Google #SafeBrowsing #phishingdetection #dns #registration #infosec #malicious