Stop the attacks from the platforms you trust

An attacker registers a free account on a real SaaS service. They find a user-controlled field that gets rendered into transactional email: a profile name, an invoice memo, a meeting description, a PowerBI report notification. They write the lure into that field. Then they trigger the platform's own workflow. The platform takes the attacker's string, runs it through its templating engine, and emits a fully authenticated email. Real domain, real DKIM, real reputation. The malicious content was authored and signed by the legitimate provider. There's nothing to detonate. The lure is the message itself.