Security·
Scammers turned a Microsoft notification address into a spam relay. The emails pass SPF, DKIM, and DMARC.
Spammers found a Tenant Name injection in Entra ID that pushes fraud text into Microsoft's own OTP emails. The from-line reads msonlineservicesteam@microsoftonline.com.