Push recently identified a novel phishing attack using Active Directory Federation Services to get Microsoft to send victims to a phishing site.