Fake Microsoft Teams Billing Phishing Alerts Reach 6,135 Users via 12,866 Emails

Check Point Research has identified an active phishing campaign that leverages legitimate Microsoft Teams guest invitation emails to display fake "Subscription Auto-Pay" billing notices (often using character substitutions) which include fraudulent phone numbers; victims are encouraged to call and surrender payment or credential information. The campaign has sent ~12,866 emails (~990/day), impacted ~6,135 users, and disproportionately targets education, technology/SaaS, and manufacturing, with the majority of activity observed in the United States.