The email four people reported this morning is malicious.

• The sender domain acme-payrol.example was registered two days ago.
• The link leads to a credential-harvesting page that imitates our SSO login.
• No one submitted credentials according to the SSO logs.

A subagent searched every mailbox for the same message: 23 copies, all quarantined.

Safe to leave quarantined for now.

• All 23 copies are held, not deleted, so we can restore any false positive.
• None of the recipients opened the link according to the click logs.

Blocked acme-payrol.example at the mail gateway and added it to the DNS sinkhole list.

The domain's registrar is rated high-abuse, so I also queued a takedown report.

Subject: Phishing email reported this morning - no action needed

Thanks for reporting the payroll email. It was a phishing attempt and has been removed from every mailbox. If you clicked the link, please tell us today; otherwise nothing more is needed.

Security team

Reporting the phishing site to the hosting provider and to the browser safe-browsing list is done. Takedown typically takes 24 to 48 hours.