The latest email scam looks like an invitation to a party from someone you know. But their email was hacked. If you click the invite, you’re likely to get hacked yourself. If you receive an unexpected invite, do not open it unless you contact the sender by phone or text and ask. Don't reply to the email; if their account has been taken over, you'd be asking the scammers.
Summary
Scammers are sending fake party invitations that imitate Punchbowl, Evite, and similar services, often from the hacked account of someone you know.
Clicking the link leads to a fake Gmail or AOL login page. Type your password there, and the scammers take over your email account.
A newer version skips the login page and downloads an installer that gives scammers remote control of Windows computers.
If an invitation arrives unexpectedly, confirm with the sender by phone or text before clicking anything.
Gmail users can upgrade their security to help protect themselves by signing in with a passkey instead of a password.
I've seen this one catch people over and over lately, clients and friends alike. Someone receives a party invitation from a person they know, clicks the link to read it, and types their email password on the page that appears. It's a phishing scam. By the time the account gets locked down, everyone in their contacts has received an invitation appearing to be from them, and there's no telling how many of those people got hacked next.
It's sneaky because it breaks the usual pattern. My standard advice is to be suspicious of anything scary or urgent. This scam looks friendly and inviting instead. Nobody's guard goes up for a birthday party.
A fake invitation email as it appears in Gmail
Variation A: Fake email login page steals your password
The email looks like an invitation from Punchbowl, Evite, or another invitation service. The link doesn't go to that service; it goes to a fake page that looks like the sign-in screen for Gmail, AOL, or Yahoo and asks you to sign in to view your invitation. Type your email address and password there and you've handed over your keys. The scammers sign in to your real account and send the fake invitation to everyone in your contacts. Each victim becomes the trusted sender for the next round.
Variation B: The link loads a remote-control app onto your Windows PC, allowing hackers to take over your computer
The fake invitation page downloading an installer file on a Windows PC
A newer version skips the fake login page. The invitation claims it can only be viewed on a Windows computer, and the page downloads an installer file instead of showing any party details. That installer quietly sets up remote-control software that gives the scammers the same access as a remote IT technician, even after a restart. The file can't run on a Mac, but many of my clients have a Windows PC in the house or family members who do.
If the file was opened on a Windows PC:
Disconnect the computer from the internet right away: turn off Wi-Fi, unplug the network cable, or unplug your modem or router. The scammers' remote connection dies with it.
Open Settings, then Apps, then Installed apps, and remove anything named ScreenConnect Client, the program this scam installs. You may want to remove any other unfamiliar apps. Google their names if you don’t know what they are.
Run a full scan with a security tool. I recommend Malwarebytes, which is free to download, run, and uninstall.
Change your important passwords, starting with email, from a different device. Your email password is extra sensitive: a hacker with access to your email can request a password reset on almost anything else.
If you're not confident the machine is clean, have someone who works on PCs check it before you use it for email or banking again.
What should I do when an unexpected invitation arrives?
Contact the person who supposedly sent it, by phone or text, and ask. Don't reply to the email itself; if their account has been taken over, you'd be asking the scammers.
How do passkeys protect your email account?
Now might be a good time to consider enabling and using passkeys, which can help protect you from many scams. As I explain in my post on what passkeys are and why they beat passwords, a passkey works only on the real website it belongs to. A fake page can copy Google's look, but it can't trigger your passkey, and there's no password for you to type. If you use Gmail, you're in luck: Google has implemented passkeys more thoroughly than any other email provider. Here's how I set this up for clients:
Older Google settings screenshot. Keep your tested sign-in and recovery methods; you do not need to remove them to use a passkey.
Go to myaccount.google.com, open the Security tab, and create a passkey under "How you sign in to Google." On an iPhone or Mac, it saves to iCloud Keychain and syncs across your Apple devices.
Turn on "Skip password when possible" if you prefer signing in with a passkey. This does not disable your password or other sign-in options.
Test the passkey on the devices you use, and make sure you can still recover the account if those devices are lost. Two devices using the same synced passkey are not independent recovery methods.
Keep your existing sign-in and recovery methods while you check that you can use and recover the account. Adding a passkey does not make an ordinary Google Account passkey-only. If you keep backup codes, store them securely and enter one only after navigating directly to Google, never after following an unexpected message link.
Use your passkey when it is offered. If an unexpected message leads to a page asking for your Google password, stop and navigate directly to Google. For stronger sign-in requirements, Google's Advanced Protection Program requires a passkey or security key. Before enrolling, check whether it supports the apps you use and follow Google's recovery preparation, including adding a recovery email and phone number. Recovery can take longer under Advanced Protection.
What if I already typed in my password?
Move quickly, in this order:
Change your email password from a device you trust.
If you use Gmail, review the security settings in your Google account and remove any mystery email addresses, phone numbers, or devices the scammers may have added.
Check your Sent folder and warn anyone who received a fake invitation from you.
Set up and use a passkey as described above to make fake Google sign-in pages less effective. Passkeys resist phishing during sign-in, but they do not protect you from malicious downloads, stolen signed-in sessions, or attacks through other sign-in and recovery methods.
Is this scam Punchbowl or Evite's fault?
No. The scam emails don't come through their systems. The hackers are borrowing familiar names, the way a counterfeiter sews a famous label onto a fake handbag, and there's nothing the companies can do to stop it. But if you're the one hosting parties, consider skipping these services. Every real invitation you send trains your friends to click links in invitation emails, the exact habit this scam depends on. A plain email or text in your own words gets the RSVPs without giving the scammers a practice run.
Key takeaways
Confirm any unexpected invitation with the sender by phone or text, never by replying to the email.
Never type your email password or download a file to view an invitation. Real invitations require neither.
If you use Gmail, set up and test a passkey, and keep tested recovery options. Consider Advanced Protection if you need to require a passkey or security key, after checking app compatibility and recovery requirements.
If you host events, invite people with a plain email or text so your guests never get used to clicking invitation links.
Further reading
Reduce scam risks by disabling 'Use Smart Addresses' in Apple Mail
If you'd like help setting up passkeys, checking whether your accounts have been compromised, or building better defenses against phishing scams, that's exactly what I do during a digital security audit. I offer one-on-one tech tutoring in San Francisco and Washington DC in person, or over Zoom anywhere. Book a session, and we'll lock things down together.