Callback phishing via invoice abuse and distribution list relays · Blog · Sublime Security

**Executive Summary:** This report describes a series of callback phishing campaigns where attackers create or compromise service accounts and use automated distribution lists to redirect legitimate-looking invoices (containing malicious phone numbers) to large numbers of targets while preserving the original sender, enabling scalable social-engineering attacks across Microsoft 365, PayPal and other services; Sublime outlines the attack steps, observed variants, detection signals, and mitigation guidance.