The Trello Invite Whose Subject Line the Attacker Wrote

The subject line came from trello.com, signed with Trello's own DKIM key, and passed DMARC at p=reject. Nearly every word of it was written by the attacker.

It read like this, with the borrowed name redacted:

[the bank's CEO] ([bank name] 𝓒𝓔𝓞) invited you to their board (Attention Needed) Confidential Executive Review: Regulation - Sanction - Compliance

Only "invited you to their board" belongs to Trello. Everything before it is a profile display name. Everything after it is a board name. Both are free-text fields that any account owner fills in, and the attacker filled them in to target a regulated digital bank.

Two text boxes became a vendor-sent subject line

The setup needed no infrastructure at all. The attacker registered a Trello account on a Proton Mail address, then set the profile display name to the bank's CEO, followed by the bank's name and the word "CEO" in Unicode Mathematical Bold Script capitals (U+1D4D2, U+1D4D4, U+1D4DE). Then they created a board titled "(Attention Needed) Confidential Executive Review: Regulation - Sanction - Compliance" and invited an employee's work address.

Trello's mail system did the rest. The message headers name the template as trello-electric-invite-board-modernized-pp, genuine Atlassian output and not a lookalike. Trello stitched the two attacker fields into the subject and the body heading, and the email arrived from invitation-do-not-reply@trello[.]com through Amazon SES.

Pick a pretext and it lands. For a bank, "Regulation - Sanction - Compliance" is not abstract. Sanctions exposure is the kind of topic an employee does not want to be the one who ignored, and "Confidential Executive Review" tells them not to ask around first.

The glyphs are a supporting detail, not the story. They make "CEO" look like a styled badge rather than text a stranger typed. Pretexting is 6% of initial access vectors in the 2026 Verizon Data Breach Investigations Report, and this is pretexting delivered by a trusted vendor's mail server.

The one field the attacker could not write

Here is where the template worked against the attacker.

Trello's invitation heading prints the inviter's account email right after the display name. So the body read: the bank's CEO, then account.board.review+[bank name]@proton[.]me, then "invited you to their board."

The attacker wrote the name. Trello wrote the address. A CEO of a regulated bank does not invite staff to a confidential compliance review from an anonymous free-mail box named "account.board.review."

The subaddress tag is telling too. The part after the plus sign matches the target bank's name. Plus-addressing delivers to one mailbox, so this does not prove separate accounts per target. It does suggest the same Proton mailbox may be reused against other organizations under different tags, which makes the base address worth hunting on.

Most security awareness advice says "check the sender address." In SaaS notification mail that advice points at the wrong field. The From address here is legitimate Trello. The field that matters is the inviter address the platform prints inside the body.

See Your Risk: Calculate how many threats your SEG is missing

How the message moved through the bank

The record shows one external hop: Amazon SES (216[.]221[.]175[.]148, legitimate Atlassian outbound) to the bank's Gmail-hosted mailbox. Current-hop authentication was clean: SPF pass on Atlassian's bounce domain, DKIM pass for both trello.com and amazonses.com, DMARC pass for trello.com. There was no forwarding hop and no downstream gateway rewriting.

All 16 links pointed to trello.com, id.atlassian.com, track.atlassian.com or Atlassian social pages, and every one scanned clean. No attachment. No QR code. The "Go to board" button led to an Atlassian signup flow built for an invitee with no existing account, then on to the board.

What the board contained is not in the record, so we will not guess at it.

The original reached one employee. Forwarded copies then reached three more employees. Who forwarded them, and why, was not recorded. An employee reported the message, and the IRONSCALES first-time-sender banner had flagged trello.com as new to this tenant. The automated SOC label was SPAM, citing the external Proton inviter, the urgency in the subject and the unsolicited internal spread. No human verdict has been recorded, so we frame this as an impersonation lure and attribute it to no named actor.

User reporting carried this one. That is the case for treating employees as sensors, which is the premise behind human-element defense.

MITRE ATT&CK mapping

• T1566.002, Spearphishing Link: a board invitation link aimed at a specific bank employee.
• T1585.002, Establish Accounts: Email Accounts: a free Proton Mail account used to register the Trello profile.
• T1036, Masquerading: a display name copying the bank's own CEO, with a glyph-styled title.

Indicators

Hunt on the inviter, not the sender

The defensive move is narrow and practical. Treat display names and titles in SaaS notification mail as attacker-written content, because they are. Treat the platform-printed inviter address as the identity of record.

Concretely:

1. Alert on internal executive names in SaaS notification display names. A Trello, Asana or DocuSign sender whose display name contains your CEO's name is worth a look every time.
2. Flag mathematical alphanumeric code points (U+1D400 to U+1D7FF) in display names. Legitimate business users rarely style their job titles in bold script.
3. Parse the inviter address out of invitation bodies. An external free-mail inviter claiming an internal executive identity is a strong signal. Search for the base address across the tenant, ignoring the plus tag.
4. Give staff a simple rule: a real executive inviting you to a board uses their corporate account, and the platform will show you which account that is.

Business email compromise (BEC) no longer needs a lookalike domain when a real vendor will typeset the pretext for free. The FBI IC3 2024 report keeps BEC among the costliest complaint categories, and the IBM Cost of a Data Breach 2024 report puts phishing among the most common and expensive initial vectors. The Microsoft Digital Defense Report 2024 tracks the same drift toward abusing legitimate cloud services. CISA phishing guidance still centres on verifying identity out of band, and here the platform handed defenders the identity to verify.

Across 36,000+ security professionals at 18,000+ organizations, IRONSCALES platform data shows the same pattern repeating: the content of a trusted notification is only as trustworthy as whoever typed it. In this invite, the attacker typed almost all of it. Trello typed the one line that gave them away.