Service Workflow Misuse

The attacker used a service as any customer would, for example sending a signature request, file share, or calendar invite through it. The service works normally, and the risk is in what was sent.