The Phish Zoom Signed With Its Own DKIM Key

An attacker created a Zoom account whose name field contained a scam script, triggered Zoom's sign-in verification email (which Zoom signed with a valid DKIM key), and then resent that legitimately signed message through a throwaway relay to a company's COO. The email displayed real Zoom branding and links, included a fabricated $986.37 PayPal charge and a callback number (+1-805-600-1572) as the sole payload (a telephone-oriented attack delivery, TOAD), bypassing link/attachment-based defenses and relying on social engineering to defraud the recipient.