By Jackson Godwin. Cybersecurity Analyst & Penetration Tester
The Wedding Invitation That Installed Malware
Disclaimer: This story is fictional but inspired by real malware campaigns that use fake invitations and social engineering to trick people into installing malicious software. It is written to educate readers about recognising and avoiding these attacks.
It Started With a Friendly Message
It was a quiet Saturday morning.
I was relaxing at home when my phone buzzed.
A WhatsApp message had arrived from an unfamiliar number.
Normally, I ignore messages from people I don’t recognise.
But this one immediately caught my attention.
The message simply read:
“Hello! It’s been a long time. I hope you’re doing well. You’re invited to my wedding next month.”
Underneath the message was a smiling bride and groom emoji.
It seemed harmless.
I Thought I Knew the Person
As I looked at the profile picture, the face seemed familiar.
Not someone I spoke to regularly.
But perhaps a former classmate.
A distant relative.
Or someone I had worked with years ago.
The longer I stared at the photo, the more convinced I became that I recognised the person.
That uncertainty worked in the scammer’s favour.
The Invitation Looked Beautiful
The sender asked me to open the digital wedding invitation.
Instead of attaching a normal image or PDF, they sent a link.
The message said:
“Please click below to view the invitation and confirm your attendance.”
Curious, I tapped the link.
A colourful webpage opened.
It looked elegant.
Flowers.
Gold decorations.
Wedding photographs.
Everything appeared professionally designed.
Then Something Unexpected Happened
Instead of showing the full invitation, a message appeared.
“Your device cannot display this invitation.”
Below that message was another button.
“Download Invitation Viewer.”
It explained that I needed a small application to view the wedding card properly.
At first, that sounded reasonable.
Many people install apps without thinking twice.
Fortunately, I hesitated.
The Download Didn’t Come From the App Store
When I tapped the button, my phone didn’t open the Google Play Store.
Instead, it started downloading a file directly from the website.
The file had an unfamiliar extension.
It wasn’t an image.
It wasn’t a PDF.
It was an application package.
That immediately made me uncomfortable.
My Phone Displayed a Warning
Before the installation could begin, Android displayed a security warning.
It explained that the application came from an unknown source.
To continue, I would need to change my security settings and allow installations from outside the official app store.
That was a major warning sign.
Legitimate applications are usually distributed through trusted app stores unless there is a specific, well-understood reason otherwise.
I Almost Ignored the Warning
For a brief moment, I considered installing it anyway.
After all…
What if it really was a wedding invitation?
What if I accidentally disappointed someone I knew?
That thought nearly convinced me.
But another question entered my mind.
Why would someone need me to install an app just to read a wedding invitation?
The answer didn’t make sense.
One Decision Saved My Phone
Instead of installing the application, I closed the browser.
Then I searched online for the website.
What I discovered was alarming.
Several cybersecurity researchers had already identified the same website as part of a malware campaign targeting smartphone users.
The “Wedding Invitation Viewer” wasn’t an invitation viewer at all.
It was malicious software disguised as one.
If I had installed it, I might have given criminals access to sensitive information stored on my phone.
(Continue in Part 2, where I’ll explain how fake invitation malware works, reveal the warning signs hidden in the download process, and show why attackers increasingly use social events to spread malicious software.)