{"success":true,"data":{"id":"saas-platform-notification-invite-abuse-paap","label":"Platform-as-a-Proxy (PaaP) SaaS notification abuse — phishing content (toll-free callback, unauthorized charge, wire-transfer instructions) injected into a user-controlled field of a legitimate SaaS notification (GitHub commit description, Jira invite, Amazon Business invite, Google Calendar event). Email passes SPF/DKIM/DMARC/ARC because the platform itself is the sender. Talos Apr 2026: ~2.89% of GitHub notification email was malicious on a single day; one tracked campaign hit 20,049 orgs","description":"Platform-as-a-Proxy (PaaP) abuse: phishing content is injected into a user-controlled text field of a genuine SaaS notification — a GitHub commit description, a Jira \"Invite Customers\" welcome message, an Amazon Business invite's display name, a Google Calendar event description, a Trello/Notion/Slack/Asana notification. Because the email is truly sent by the platform, it passes SPF, DKIM, DMARC, and ARC; mail filters and users both see the trusted \"noreply@github.com\" sender and drop their guard. Cisco Talos (April 2026) tracked ~2.89% of all GitHub notification email on a single day as malicious; one campaign hit 20,049 organizations. The content pattern is stable: a toll-free callback number, a fake \"you've been charged $NNN\" claim or unauthorized-subscription CTA, occasionally padded with whitespace, dots, or ALL-CAPS headers to evade eyeballs. Legitimate GitHub/Jira/Amazon-Business messages do not ask you to call a 1-800 number to dispute a charge — that pattern belongs to the scammer, not the platform.","tier":"danger","category":"marketing","isThin":false}}