This attack vector exploits Microsoft Entra B2B guest invitations for phishing, where the attacker sends a legitimate-looking invitation from Microsoft's official `[email protected]` domain, bypassing traditional email security checks. The threat leverages the inherent trust in Microsoft's invitation flow, with the critical attack component being the post-acceptance redirect to a malicious landing page controlled by the attacker. The article describes this as a technique within the PhishU Framework and does not provide a CVE, CVSS score, affected software versions, a fixed version, or a workaround.
Most phishing delivery methods still force the operator to solve the same set of problems first. Pick or clone a landing page. Build or tune an email template. Stand up a sender. Worry about SPF, DKIM, and DMARC. Think about warm-up, reputation, and evasion. Then hope the target actually sees the message. Microsoft Entra B2B guest invitation phishing changes that shape completely. The sender is Microsoft. The email comes from [email protected] . The accept link is a real login.microsoftonline.com URL. There is no operator-controlled sending domain to check, no sender reputation to build, and no email template to nurse through the gateway. That is why this is the attack with no attacker domain. In the PhishU Framework, that delivery path is no longer a concept piece or a one-off script. It is a shipped technique that an operator can configure in a few clicks. Pick the delivery persona, write the invitation message, choose where the target lands after Microsoft redemption, and pair it with the downstream technique you actually want to test. The hard part is the redirect and what happens after the accept flow. PhishU handles the rest. The B2B configuration is intentionally short. Pick the delivery persona, set the inviter display name, write the invitation message, and let the Framework handle the Microsoft Graph invitation flow. No Landing Page to Clone. No Email Template to Build. That is the first practical difference operators notice. B2B guest invitation delivery is not another SMTP campaign with a Microsoft theme wrapped around it. The delivery email itself is a genuine Microsoft B2B invitation. That removes a surprising amount of operator work. There is no need to build a lure email from scratch. There is no separate sender mailbox to configure. There is no discussion about whether the right domain has been warmed, whether the mail path is aligned, or whether a target gateway will trust the sender. Microsoft is the sender. The target sees a message that already carries the trust posture users are trained to rely on. The Framework reflects that reality in the UX. The normal sender-template steps collapse away because they do not apply. Instead of pushing the operator through one more email setup workflow, the platform pivots to what actually matters for this technique: the persona tenant, the invitation text, the post-accept landing page, and the downstream action. The preview reflects a Microsoft-branded invitation email, not an operator-built SMTP lure. That is the point of the technique. The Real Trick Is the Redirect The most important engineering detail in this technique is not the email. Microsoft already solved the email. The critical piece is where the target goes after they click Accept and complete Microsoft's redemption flow. That is where the Framework's redirect handling matters. The invitation flow preserves the campaign tracking identifier across Microsoft's redemption path and sends the target to the configured post-accept landing page. That landing page is where the operator decides what the assessment actually becomes next. That is also what makes this technique more powerful than a novelty delivery trick. On its own, a Microsoft-sent invitation already tests a serious user-trust and email-security gap. Paired with the right post-accept page, it becomes a realistic social engineering workflow that can continue into OAuth Consent Grant, Device Code, or another downstream path while the target is still moving through a trust context they just accepted from Microsoft. The target receives a genuine Microsoft B2B invitation email from [email protected] . There is no attacker-owned sender domain for the target or the gateway to challenge. Why This Feels More Trusted Than Typical Phishing Traditional user advice usually focuses on sender reputation and domain scrutiny. Check the sender. Hover the link. Be suspicious of a domain that does not match the brand. That advice can still help in a lot of ordinary phishing cases, but it does not help much here. In this flow, the sender is Microsoft. The accept URL is Microsoft. The sign-in experience is Microsoft. The user moves through a chain that looks legitimate because it is legitimate Microsoft infrastructure until the post-accept transition happens. That is exactly why the technique is valuable for assessment and training. It measures whether users and defenders can spot the real risk when the old simple heuristics do not apply. For defenders, the lesson is not just that the user clicked. The lesson is that an organization can have mature email filtering and still leave a guest-invitation path effectively ungoverned. This is less about bypassing controls with a clever domain and more about exploiting a trust channel many teams do not meaningfully monitor. A Few Clicks to Pair Delivery With the Grant Path You Want One reason this technique matters inside the PhishU Framework instead of as a loose integration is that the operator can move directly...