Cybercriminals set up three different CAPTCHAs that Office 365 targets must click through before the final phishing page.
Source: Threadpost