The Platform Labelled It an Invoice, Then a High Risk

A spear-phishing campaign used Xero's genuine invoicing infrastructure and template to deliver a Nike-branded recruitment lure: authenticated messages (DKIM/SPF/DMARC pass) were sent from Xero's transactional domain and a sending pool labeled 'High Risk Pool', loaded the impersonated brand's logo from Xero's asset host, and contained a single unwrapped malicious apply link (nike-job-listings.com). The attack leveraged platform-provisioned branding and empty invoice fields as an envelope for the lure, bypassing reputation and gateway controls; indicators of compromise and MITRE mappings are provided.