Microsoft's Own Message Recall Agent Delivered a Credential Harvest

**Executive summary:** A targeted credential-harvesting phishing message abused Microsoft's Transport Message Recall Routing Agent to appear as an internal 'Message Recall Report' (AuthAs=Internal, AuthMechanism=05, Direction=Originating) and instructed recipients to enter email/password via a legitimate outlook.office.com recall link; detection flagged it as high risk (Themis 72%) and four mailboxes were quarantined, and the report provides IoCs and MITRE mappings (T1534, T1078, T1566.002).