Phishing emails usually try to look like something the recipient already knows. A campaign described on October 12, 2026 by researchers in coverage from ISMG goes much further: instead of imitating an existing event, the threat actor invented one, complete with a venue, a program, a speaker lineup, ticket tiers and sponsorship packages. Proofpoint, the security firm tracking the group behind it as TA586, described the actor as an initial access broker for ransomware, meaning its job is to open the door that other crews later walk through.
The conference that never existed
The website promoted BioTold as a two day biotechnology conference on November 5 and 6 at the Omni Boston Hotel at the Seaport, promising that every speaker would be a working practitioner sharing real, first person stories. The level of detail was the point. The site claimed the event planner chose Boston because the city has the densest biotech community on earth, listed an opening keynote by Harvard geneticist George Church, and showed sponsorships from companies like Thermo Fisher Scientific alongside an advisory board of scientists affiliated with institutions like the Broad Institute.
None of the borrowed credibility was real. When reporters contacted the people and organizations named on the site, most listed sponsors, advisers and speakers said they had never heard of the conference and were not involved with it. A spokesperson for the Wyss Institute confirmed that George Church is not speaking at BioTold and is instead speaking at a real conference at the Hynes Convention Center. The hotel named as the venue also said it is not affiliated with the event and received a wave of calls about it, including room availability inquiries. The site even sold tickets at 149 dollars for early birds and 299 dollars for general admission, with sponsorships priced from 5,000 to 25,000 dollars, though selling seats was not the goal.
How the attack chain worked
According to the researchers, the website itself was not designed to deliver malware. Its job was to make the emailed invitations look legitimate. TA586 sent messages inviting recipients to speak at or sponsor the event. When someone expressed interest, the follow up contained a different URL that led to a malware download. The researchers associated personalized follow up links and ZIP archive downloads with the operation, and noted that TA586 may overlap with a cybercrime group that another firm dubbed ZipLine. Proofpoint first saw the BioTold domain in its telemetry during fraudulent invitation activity in June 2026 and observed renewed activity in the weeks before the October report. So far, no confirmed infections tied to the fake conference have been reported.
The structure deserves attention because it separates the deception into layers. The email does not carry the payload. The website does not carry the payload. Only a human reply, expressing interest, unlocks the malicious link. That makes the campaign almost immune to pure content filtering, because the dangerous artifact appears only after a conversation has started.
Where DMARC fits, and where it does not
This is the part every sender and defender should sit with. The invitations did not spoof anyone’s domain. TA586 controlled its own infrastructure, so its mail could pass SPF, DKIM and DMARC perfectly while promoting a fictional conference. DMARC answers one question: whether the message really comes from the domain in the From line. It cannot answer whether the conference exists, whether the keynote speaker has agreed to attend, or whether the sponsor logos were used with permission.
That is not an argument against DMARC. It is an argument about the shape of the problem. Consider the mirror image of this campaign. If a criminal had instead spoofed the sending domain of a real, trusted conference brand to spread invitations, enforcement would have stopped it cold. Publishing DMARC with a quarantine or reject policy on every domain your organization owns, and reading the aggregate reports, is what guarantees that your brand cannot be drafted into someone else’s lie. Attackers inventing their own credible events is the harder half of the threat model, and it is answered by process, not by DNS.
What organizations should actually do
For any team that receives conference invitations, the defense is verification outside the email channel. Look up the venue independently and call it. Check whether listed speakers and sponsors know about the event. Treat a request to download an archive or open a link after expressing interest as a red flag rather than a natural next step. For security teams, the campaign is a reminder that the most convincing lure is not a fake invoice but a flattering opportunity, and that ransomware crews increasingly buy their access from specialists rather than breaking in themselves.
For the organizers of real conferences and for every brand whose name makes an email feel safe, the takeaway is to make your own domain impossible to impersonate. Publish DMARC, enforce it, monitor the reports, and watch for lookalike registrations. You cannot stop a criminal from inventing a conference, but you can make sure the conference that really exists is never forged.
Authentication guarantees that mail claiming to be from your domain really is from your domain, and that is the foundation every other defense stands on. Excello Mail turns your DMARC, SPF and DKIM reports into a clear picture of every service sending as your domains, so you can enforce your policy with confidence. Sign up for free to Excello Mail and make sure your brand is never the borrowed credibility in someone else’s trap.