Microsoft still insistent it’s a phishing problem, but users are saying otherwise