Scammers are exploiting a loophole to send spam links from a trusted internal Microsoft email address normally used for official account alerts. This vulnerability makes the phishing emails appear highly legitimate, significantly increasing the risk of users falling for the deceptive campaigns.