An email saying "Alex shared a document with you" that looked like a normal OneDrive message.
The link opened a fake Microsoft login page designed to capture passwords.