Microsoft has recently changed the sign-in pages for Azure AD and Microsoft 365, but threat actors have quickly began to adapt to the change. One such phishing scam that is currently going around involves emails that have a subject line like “Business Document Received”, and then ask users to click a button to access the document on OneDrive. This malicious attachment just redirects to a fake sign-in page that has the new design. If you find yourself on an Azure AD or Microsoft 365 page that has the old background with the hills and grass, you’re most likely on a phishing page! If it’s the new pearl colored background, be sure to verify that the link of the page is the official Microsoft one. For more information, feel free to check out the link below.

Source: New Microsoft 365 sign-in pages already spoofed for phishing