Phishing emails bypassed Microsoft Defender and Exchange rules and were delivered to the end user’s inbox. The email contained a malicious link embedded in the “View Document” button within the message body. Clicking this link redirected the user to an app invitation portal, prompting them to verify before viewing the document. This process ultimately led to a phishing page impersonating the Microsoft login screen, designed to harvest user credentials. Sender: system@mailer[.]crmworkspace[.]com Subject: Will Miles invited you to an event