🎉The Fake Party Invitation That Spreads to Your Contacts

In May 2000, a love letter brought the internet to its knees. The ILOVEYOU worm arrived as an email from someone you knew, and opening it mailed a copy to everyone in your Outlook address book. Twenty-six years later, the same trick is back — dressed as a party invitation.

It starts with an invite to a dinner party that looks like it came from Punchbowl, Evite, Paperless Post, or Partiful — and, crucially, appears to be from a real friend. The scam comes in two distinct forms:

• The counterfeit invite — a copycat email that only mimics the platform. The branding is borrowed, but the email actually comes from somewhere other than the platform's real domain, and clicking "view invitation" leads to a fake Google, Microsoft, or Yahoo login page built to steal your email password. Because the sender is fake, this version can be caught by checking the sender's email address and domain.
• The genuine invite, weaponized — a real invitation, created on the legitimate platform itself or sent directly from a friend's real, compromised email account. The sender is authentic, the servers are authentic, and every security check passes — because the email isn't the trap. The link waiting behind the RSVP is, and it leads to the same password-stealing page. This version can't be caught by checking the sender — only by checking with the host.

In Scamwise data we see both forms and this scheme is teetering on the verge of a viral epidemic and impacting all major online invite platforms with Punchbowl leading the pack as the most frequently hijacked brand. Scamwise is not alone, regulators around the country are picking up on the same wave as the FTC issued a consumer warning about fake party-invitation emails, and North Carolina's Department of Justice flagged the pattern in mid-June.

In all variants of this scam, email credentials are the goal. Email credentials can be the most valuable single credential a scammer can steal, because it often gives them a master key to discover other valuable accounts and unlock them through password resets tied to the stolen email account.

While the scammer is mining the stolen account for valuable information and access to other accounts they also propagate their scam to the contact list through more fake invites, giving themselves an ever-expanding trove of compromised users to exploit.

What happens inside a hijacked inbox is no longer a matter of speculation. In September 2026, Microsoft's Digital Crimes Unit disrupted EvilTokens, a phishing-as-a-service operation that had compromised more than 12,000 inboxes in a matter of months. Once inside, its customers ran what Microsoft described as deep-dive reconnaissance of email communications, searching for wire-transfer details, pending invoices and executive correspondence, mapping who the victim talked to and about what, and quietly setting inbox rules to keep copies flowing. In other words: the inbox wasn't the prize, it was the research library.

That is the lens to view the party-invite scam through. An invitation that steals a personal email password hands the scammer years of receipts, travel confirmations, school newsletters, medical portal notices and family threads. The important trend here is that this material is the raw ingredient for the next generation of imposter scams — a "fraud alert" that names your actual bank, a "package" from a retailer you actually ordered from last week, a message soliciting a donation from your actual church. We should expect hijacked-inbox contents to show up as increasingly personal, increasingly convincing targeted lures in the months ahead.

As we watch this trend, we're keeping an eye on the calendar — invitation volume spikes around the winter holidays, when an invite from a long-lost friend is least strange and holiday party e-vites from every platform are already crowding inboxes.