{"success":true,"data":{"id":"saas-workspace-admin-invoice-spoof","label":"Fake Google Workspace / Microsoft 365 / Slack / Zoom / Atlassian workspace admin invoice — sender domain does NOT match the claimed platform domain; urgency + billing-portal link redirecting to off-brand payment portal.","description":"Fake workspace admin invoice impersonating Google Workspace, Microsoft 365, Slack, Zoom, or Atlassian where the sender domain does NOT match the claimed platform domain. Workspace admins are P0 targets because they routinely receive billing emails and have authority to approve payments. The lure claims \"your Google Workspace / Microsoft 365 licenses require renewal — N seats at $X/month — pay now or services will be suspended.\" Real workspace billing comes exclusively from the platform's verified billing domain and is always accessible from within the admin console, never via cold inbound email redirecting to a third-party payment link. Detection: workspace/license/seats vocabulary + billing urgency + admin/billing-portal language + off-brand href + sender NOT on the platform canonical allowlist (google.com, microsoft.com, slack.com, zoom.us, atlassian.com) + no In-Reply-To + no List-Unsubscribe. Source: GC1-R17; FBI IC3 BEC advisory 2025; Cybersecurity and Infrastructure Security Agency (CISA) workspace phishing advisory.","tier":"warning","category":"scam","isThin":false}}