We found this fake-invoice campaign while scammers were still building it

This report describes an active phishing/phone-scamming campaign where attackers send fake invoice emails impersonating trusted brands to coerce recipients into calling callback numbers; researchers discovered partially completed templates (placeholders like #TFN# and #PRICE#) indicating the operation was caught during rollout and published associated domains and phone-number indicators along with remediation advice.