A Fake Microsoft Planner Invite From a Real Vendor Mailbox

A compromised vendor Microsoft 365 mailbox was used to send convincing Microsoft Planner project invites to four employees at a UK consultancy; messages authenticated cleanly and URL scanners flagged the single attacker link as clean, while the attacker used per-recipient 104-character tokens and unique subject lines to evade detection—human reporting identified the malicious host and stopped the campaign.