A Microsoft Clarity Field Delivered a PayPal Callback Scam

A state health-and-human-services mailbox received a genuine Microsoft Clarity collaboration invite whose attacker-written project title impersonated PayPal, quoted a $445.67 “refund” and supplied a callback number; SPF/DKIM/DMARC/ARC and link scanning all passed because the message originated from Microsoft, so the scam relied on semantic deception rather than compromised infrastructure. The message was reported and quarantined; the report provides the phone number, lure text, join URL, sending address, full authentication results, MITRE mappings, and recommendations to inventory vendor notification capabilities, alert on billing/refund vocabulary or phone numbers in vendor notifications, and keep reporting frictionless.