message from him (in a tone that he would use) asking why they haven't accepted a meeting invite. They click the link which has them authenticate, and then they get the "you got busted" splash screen that forces them into mandatory training. Its through Microsoft so I get nice metrics on who opened the email, who deleted it, who clicked the link, who put in credentials, and also who reported it to IT (our company policy). The email is full of hints from spelling errors, to coming from an email thats outside our company (with a flag on it), his signature has "Have a blessed day kindly in the year of our Lord", and the link is in plain text which has nothing to do with Microsoft or our company.