Fake party invitations appearing to come from trusted contacts are being used to steal email logins, spread the scam further, and potentially lead to financial fraud, experts warn.