Fake Xero invoices are being used to disseminate Office 365 phishing.
You receive an HTML extension invoice file from a fake Xero address and upon opening are presented with a fake Office 365 login with the site name bing the local HTML file on your computer.