A Fake Malwarebytes Renewal, Signed by Google

An attacker registered betskl.com and used a Google Calendar invite impersonating "Malwarebytes Security Operations" to deliver a callback-phishing (vishing) lure to a senior executive; the invite contained two phone numbers and an invoice story but no malicious links or attachments, bypassing typical email filters (valid DKIM, clean ICS) and relying on social engineering. The message was reported by the executive, Themis scored it as suspicious, and it was quarantined; key IOCs are domain betskl.com, organizer [email protected], phone numbers +1 (810) 221-4201 and +1 (810) 228-4980, and ICS MD5 b88fb7580172f37f76b27af153d1d5b4.