Honest phishing: the alert is fake, the attack is real

An Office 365 security alert as bait in a phishing email.