Email Spoofing

A user reported receiving phishing emails, including one spoofed from their own email address, and noticed random unsent emails in their sent folder despite no malicious login attempts and multiple password changes.

Scammers have discovered a loophole in Microsoft's internal systems that allows them to send spam and phishing emails using legitimate Microsoft email addresses normally reserved for account alerts. This vulnerability enables fraudulent actors to impersonate Microsoft and deceive users into clicking malicious links.