{"success":true,"data":{"id":"fake-linear-team-workspace-billing-phish","label":"Fake Linear team workspace billing suspension phishing — impersonates Linear with a workspace-suspended or subscription-cancelled urgency + billing-update CTA at a non-linear.app host. Proofpoint 2025-2026.","description":"Phishing emails impersonating Linear (issue tracker) claiming a team workspace has been suspended or a subscription cancelled due to a billing failure, directing victims to a fake billing portal harvesting credentials and payment card data. Three-part detection: (1) Linear workspace / team / organization / subscription language, (2) workspace-suspended or billing-failed urgency, (3) restore / reactivate / billing-update CTA with off-linear.app link. Proofpoint 2025-2026 documented developer-tool SaaS impersonation campaigns; active campaigns targeting engineering teams confirmed. Score +3: narrower developer audience targeting compared to consumer-facing platforms, but high-value target given Linear's use in managing production engineering workflows.","tier":"danger","category":"phishing","isThin":false}}