The Trello Invite Whose Subject Line the Attacker Wrote

A high-risk targeted phishing lure abused Trello's invitation template to impersonate a bank CEO by populating free-text profile and board name fields (including Unicode mathematical-bold glyphs) so the genuine Trello-sent email (SPF/DKIM/DMARC passing) appeared legitimate; the attacker- owned Proton Mail inviter printed in the invitation body is the key indicator revealing the impersonation. The report includes the inviter address, Trello board URL, subject fragment, MITRE mappings (T1566.002, T1585.002, T1036), and practical defenses: alert on executive names in SaaS display names, flag mathematical-alphanumeric code points, parse inviter addresses from invitation bodies, and verify executive invites use corporate accounts.