{"success":true,"data":{"id":"dropbox-share-cross-domain","label":"Fake Dropbox shared-document or shared-folder invitation sent from a non-Dropbox domain — credential-harvest cross-domain phish; the \"view document\" CTA leads to a lookalike Dropbox login page. Real Dropbox sharing mail originates from dropbox.com / dropboxmail.com only.","description":"Fake Dropbox shared-document, shared-folder, or \"someone shared a file with you\" invitation sent from a non-Dropbox sending domain (From / Reply-To / link domains do not align with dropbox.com / dropboxmail.com) directing the recipient to a \"view document\" or \"open shared folder\" link — credential-harvest cross-domain phish that abuses the implicit trust of file-sharing notifications. Real Dropbox sharing communications originate exclusively from dropbox.com / dropboxmail.com / no-reply@dropbox.com with DMARC-aligned signing; shared-link CTAs always terminate at dropbox.com, never at third-party domains. Sharing-notification lures are highly effective because clicking a \"view document\" link feels routine and the credential-prompt that follows looks identical to the real Dropbox login. Distinct from generic file-share-phish — this targets the Dropbox brand / someone-shared-a-file / cross-domain From-link mismatch pretext. Detection: Dropbox brand vocabulary (shared document, shared folder, view document, someone shared with you) + sender or link domain ≠ dropbox.com / dropboxmail.com + no DMARC alignment. Trash score: +4. Source: GC1-R31; APWG Dropbox phishing report 2025; Dropbox anti-phishing guidance; CISA file-sharing impersonation alert.","tier":"warning","category":"other","isThin":false}}