The Phish Arrived as an Automatic Reply You Never Asked For

A phishing campaign leveraged Exchange Online automatic replies from a likely throwaway M365 tenant to deliver a branded scareware lure; the replies were legitimately generated and signed by Microsoft but contained a linked image and unsubscribe link both pointing to a reurl.cc shortlink. The report documents headers showing auto-generated mail (null Return-Path, Mailbox Rules Agent, In-Reply-To pointing at an unseen trigger), lists indicators (sender [email protected], tenant lakcyt.onmicrosoft.com, shortlink https://reurl.cc/dqml3g, image host artfulnormal.com), and recommends checking conversation history and not treating auto-generated mail as inherently safe.