"Join the call now" — Spoofed Webex Meeting Invitation

Credential Harvesting Brand Impersonation: Webex / Cisco Urgency Lure

Email as Recipient Saw It

From"Webex" <Webex@mailer-sender.com>1

ToUser Name <user.name@argyleisd.com>

SubjectEXTERNAL2Join the call now

DateTuesday, May 19, 2026 8:27 AM

User,

Courtney Carpenter3 has invited you to join a Webex call. Click the link below to join the call now4.

5 No meeting ID, password, time, or dial-in details shown

6 Open in Browser 7

The Webex Team
Need help? Contact us.

Phishing Indicators 8 red flags

The display name says "Webex" but the address is on an unrelated domain.

Webex@mailer-sender.com

The mail gateway flagged this as originating outside the district.

Attackers commonly use familiar internal names to make messages feel legitimate.

"Join the call now" pressures the recipient to act quickly.

Authentic Webex invitations include meeting number, password, time, and dial-in info.

The button points to a non-Webex, non-Cisco domain.

login-service.authorizationservice.com

Real Webex meeting buttons usually say "Join meeting."

The footer is used to make the message look official.