Asana Platform Abuse: Authenticated Amazon SES Delivery for a Fake Meta Workspace Invite

The email looked exactly like a legitimate Asana workspace invitation. The formatting matched Asana's standard notification template. The links pointed to app.asana[.]com. The sending infrastructure was Amazon SES, which is how Asana actually delivers its notifications. SPF, DKIM, and DMARC all passed for asana[.]com.

The claimed inviter was Meta.

The inviter's actual email address was a randomized string on a domain with no web presence, registered recently with privacy protection and no verifiable connection to Meta or any other technology company.

The Attack Architecture: Using Asana as the Delivery Channel

To send an Asana invitation, the attacker simply needed an Asana account and the ability to create a workspace. No compromised account, no zero-day exploit, no malicious domain to put in an email. The attacker registered a fresh domain with a privacy-obscured registrar, created an Asana workspace, and sent an invite claiming the organization behind it was "Meta" with a reference to an account number.

The inviter address, formatted as a 10-character randomized local part at daouse[.]com, provided no meaningful identity. daouse[.]com was registered through Domain Collage LLC with privacy-protected WHOIS. At delivery time, the domain had been active for a relatively short period with no documented web presence.

The recipient at a digital advertising company received a notification from what appeared to be a Meta-initiated workspace join request.

Full Authentication, Every Link to Asana, Nothing to Block

The email passed every authentication check:

• SPF: pass (Amazon SES sending IP 54[.]240[.]65[.]107 authorized for asana[.]com)
• DKIM: pass (signed for asana[.]com)
• DMARC: pass (aligned with DKIM signing domain)
• compauth=pass

All links in the notification pointed to app.asana[.]com endpoints: registration, accept-invite, and login flows. These scanned clean because they are clean. They are real Asana URLs. There was no external credential harvesting page to detect, no attacker domain to block, no malicious payload in the attachment.

The attack surface was inside Asana itself. Once the recipient accepted the invite, the attacker-controlled workspace would become the attack environment. Content placed inside the workspace after invite acceptance (fake login prompts, malicious file links, social engineering messages) would be delivered within a platform the recipient had just voluntarily joined.

This is the structural characteristic of email spoofing via SaaS platform abuse: the email delivery phase is fully clean and authenticated by design. The attacker is not bypassing the authentication system. The attacker is using it correctly to impersonate a trusted brand.

The Inviter Domain: All the Red Flags That Authentication Ignores

daouse[.]com carries every attribute associated with single-use phishing infrastructure. Privacy-protected WHOIS. Recently registered. Registered through a registrar (Domain Collage LLC) that appears consistently in phishing campaigns. No web presence. No established relationship with the recipient organization. The randomized local part (34q6n9ctpm@daouse[.]com) means the address has never been seen before and provides no reputation signal.

Authentication for asana[.]com tells evaluators nothing about daouse[.]com. The two domains are independent. Asana sends the notification. Asana's authentication is what passes. The inviter's domain is referenced only in the notification body as the organizer. No SPF or DKIM evaluation touches daouse[.]com in this flow.

This is the fundamental gap in authentication-centric evaluation: the system that is being authenticated (Asana) is not the party whose trustworthiness matters for this decision. The party whose trustworthiness matters (the operator behind daouse[.]com) is not evaluated by authentication at all.

What Behavioral Analysis Found That Authentication Missed

The recipient had no established relationship with the claimed inviter. The claimed inviter identity (Meta) did not match any known partner or vendor. The inviter address used a randomized local part on a freshly registered, privacy-protected domain. No recipient personalization was present in the template, consistent with bulk campaign delivery.

Themis, the IRONSCALES Adaptive AI engine, flagged this message by correlating signals that authentication alone cannot produce: the gap between the claimed inviter identity and the actual inviter domain's characteristics, the absence of any prior relationship between the recipient and the inviter domain, and the pattern of platform abuse via SaaS invitation as a delivery channel. These are behavioral signals requiring contextual knowledge of the recipient organization's vendor relationships and domain-age data on the inviter, not just header parsing.

The IRONSCALES platform linked to here provides the platform capabilities that surface these multi-signal behavioral verdicts on messages that pass every technical filter.

Within the broader community threat feed, the Asana platform abuse vector had appeared in prior campaigns targeting technology and advertising sector organizations. Community intelligence on that pattern accelerated the detection verdict.

The Broader SaaS Abuse Threat

Asana is one of many platforms that can be weaponized this way. Google Calendar, Trello, DocuSign, SharePoint, Dropbox, and other widely used SaaS tools all have notification and invitation flows that, when abused, produce fully authenticated emails with no attacker-controlled delivery infrastructure. The legitimate platform's authentication credentials every message.

Defenders who rely on domain reputation, URL scanning, and authentication results as their primary signal layers have no technical indicator to act on when the entire delivery chain is genuinely clean. The detection surface is behavioral: unexpected invitations from claimed organizations with no established relationship, using inviter addresses on freshly registered privacy-protected domains, sent without personalization to recipients whose roles are publicly visible on platforms like LinkedIn.

See Your Risk: Calculate how many threats your SEG is missing

Indicators of Compromise

MITRE ATT&CK Mapping