We have seen a new variation on the common exceeded storage limit notification. This is titled ‘Account Expiration’ and the sender it ‘IT Help Desk’. The message has a link to fake Office 365 login page hosted on Office 365’s own forms platform. The message has a copyright footer in an attempt to look authentic, but is written ‘Office Microsoft 365’ which Microsoft would never use in their own branding. The email appears to come from a legitimate mail system from a US business, Hughes.