{"success":true,"data":{"id":"fake-entra-b2b-external-guest-invite-phish","label":"Fake Microsoft Entra B2B external guest invite phishing — abuses the legitimate invites@microsoft.com cross-tenant invitation mechanism to grant attackers cross-tenant access to the victim's Microsoft identity. CISA AA24-038A; Unit 42 2025-2026 (340+ M365 orgs compromised).","description":"Phishing email impersonating Microsoft Entra B2B guest invitations from a lookalike sender. Real Microsoft B2B invites are sent from `invites@microsoft.com`; spoofs come from typosquats (microsft-*, microsoft-secure-*) and arbitrary third-party domains that mimic Entra B2B body patterns + invitation-expiry urgency. Three-part detection: (1) sender is NOT `invites@microsoft.com` (EA-R7M-01 inverted guard — pre-fix logic flagged every legitimate Microsoft invite), (2) external-collaboration / guest-account / tenant language, (3) invitation-expiry urgency, no In-Reply-To (cold outreach). CISA advisory AA24-038A; Unit 42 2025-2026 documented 340+ M365 organizations compromised via Entra External ID invitation abuse.","tier":"danger","category":"phishing","isThin":false}}