McAfee Invoice Scam Weaponized a Google Calendar Invite 71 Minutes After Domain Registration

Attackers registered cytrust.org and provisioned Google Workspace to send Google Calendar invoice invites impersonating McAfee that contained a Flint, MI callback phone number instead of links or attachments; the campaign leveraged valid Google DKIM and minimal DNS records to evade gateway controls, and the report provides IoCs and mitigation guidance.