Threat actors are abusing #Microsoft infrastructure to conduct callback #phishing attacks.
They register Microsoft 365 tenants with names crafted to include lure messages such as fake purchase alert containing a fraudulent support contact. They also use .onmicrosoft.com
