A phishing campaign is leveraging Microsoft 365 infrastructure for attacks.