Fake Workato / Tray.io enterprise iPaaS subscription payment failed, automation workflows stopped, enterprise integrations suspended, or business workflow automation no longer running phishing

Phishing emails impersonating Workato or Tray.io claiming the enterprise iPaaS subscription payment has failed, automation workflows have stopped, enterprise integrations are suspended, or business workflow automation is no longer running — directing them to update billing or restore access through a credential-harvesting portal. A distinct attack category targeting enterprise integration platform as a service (iPaaS) tools that automate mission-critical business workflows across Salesforce, NetSuite, Workday, and hundreds of enterprise applications. Key facts: (1) Workato serves 17,000+ customers ($10,000-100,000+/year enterprise pricing) as the dominant enterprise automation platform for business teams — Workato is where IT operations and RevOps teams build the automation recipes that connect Salesforce to NetSuite (order-to-cash), Workday to active directory (employee provisioning), HubSpot to Salesforce (lead routing), and hundreds of other cross-system workflows; a Workato subscription suspension simultaneously stops every running recipe across every integration, halting AP automation, HR onboarding workflows, customer success automation, and the revenue operations workflows that move data between systems in real time; (2) The 'enterprise integrations stopped running' hook targets IT operations administrators and RevOps teams who are deeply familiar with integration failures — these users understand immediately that a workflow automation outage creates cascading failures across every connected system; when Salesforce-to-NetSuite sync stops, new orders aren't created in ERP; when Workday-to-AD sync stops, new employees can't get system access; when HubSpot-to-Salesforce sync stops, leads accumulate in marketing without reaching sales; (3) Tray.io serves 1,000+ enterprise customers ($3,000-50,000+/year) with particular strength in data operations and complex multi-step workflows — Tray.io customers typically build workflows that orchestrate 10+ API calls in sequence; a Tray.io suspension breaks every automated pipeline simultaneously; (4) Unlike Zapier/Make (consumer/SMB automation), Workato and Tray.io operate at the enterprise scale: a single Workato recipe may process 100,000+ records per day, sync financial data between ERP and CRM systems in real time, and trigger downstream actions in 10+ enterprise applications — a recipe outage is a business operations emergency, not an inconvenience; (5) Workato and Tray.io credentials expose the complete integration architecture of the enterprise: every API key and OAuth token used across every connected application (potentially giving access to Salesforce, NetSuite, Workday, Slack, and dozens of other enterprise systems through the stored credentials), the complete data transformation logic, and the business logic embedded in automation recipes. Warning signs: sender not workato.com/tray.io; genuine Workato billing at app.workato.com/settings/billing; Tray.io billing at app.tray.io/settings.