Attackers are disseminating fake Microsoft account notifications alerting users to supposed “unusual sign-in activity” in a ploy to steal credentials.