Anyone else seeing more "pages.dev" phishing targeting M365 lately?

Over the last couple of weeks, I’ve been seeing more phishing involving Cloudflare "*.pages.dev" URLs targeting M365 users.

I’m curious whether others are also seeing more than just credential theft after compromise, for example:

- inbox rules created to hide messages

- auto-forwarding to external addresses

- redirection into RSS / Archive / Junk

- MFA changes or new auth methods added

- session/token reuse after password reset

Have others seen the same pattern recently in M365 / Outlook environments? Any field observations, reports, or writeups would be appreciated.