Why am I suddenly getting so many spam emails on outlook.com from an apparent AI bot?

The last time I had this issue, Microsoft actually told me that their spam filter takes precedence over any rules you have set up. At that time, nearly 50% of my legit mail was going to the spam folder. Now, I get anywhere from 20-40 spam emails IN MY INBOX everyday. I report them as junk, I report them as spam. Doesn't matter, it's a daily hassle. I am about 95% complete with changing my email with everything I haver registered, and I am done with Microsoft.

As for your question, it's annoying, it's frustrating, it's a waste of time, and it doesn't matter because let's face it, Microsoft is to big to care, and they don't. Not many companies can get away with taking 9 months (yes, 9 months) to fix a major security vulnerability like that had with Azure in 2023, but people and companies won't move away from Microsoft so they have no motivation.

all this relentless spam has caused me to do quite a lot of searching and reading in an attempt to come up with a solution or at least to staunch the flow as much as possible,

I've been partially successful,

but from what I've learned I've come to a rather simple conclusion:

Microsoft could stop the flow of identified spam overnight,

each email has to pass authentication and then go through the spam filtering process, you can see it all in the message source information, this is how outlook decides whether to deliver it to your inbox or junk mail box,

if, when a message fails authentication and the spam filters and becomes 'identified as spam' Microsoft bounced this message back to the sender via the return path with a Postmaster template message saying: your email failed to meet criteria for delivery on these specific counts, and listed where it failed authentication and spam filtering,

well it would instantly stop all 'identified as spam' currently being delivered,

if the sender was legitimate, a business or marketing operation, they'd have the bounce back message, they'd know in what manner they have to improve the transparency and deliverability to continue their email campaign,

if the sender was malicious, they'd have no interest in transparency, they often either supply a bogus return path or none at all, so they'd not even receive the bounce back message, their only interest is really getting live links embedded in emails into your account in the hope you click on them and are redirected to a scam site or somewhere that will try to install malware,

they're not interested in communication, the email is just a delivery vector for their payload, basically it's a trap.

if I can figure out how to simply end spam over night, it begs the question: why haven't they done this simple thing a long time ago?

I identified that most spam mails, in my case, didn't have a sender address. Then i found this workaround (with rules) that worked out fine for me. It it hard to understand why Microsoft isn't block these kind of messages. Especially when Google do.

SPAM with NO SENDER EMAIL - Microsoft Community

But i used the action to move message to a Folder instead of delete.

That type of phishing, implying a sense of urgency, especially involving an account that is going to be canceled or a package that’s going to be returned to the sender, is designed to get people to panic and click, thinking that they’re about to lose access to their bank or some other valued account. It’s a classic phishing technique.

Look at the addresses that it’s sending to, and the address that sending from. It’s the similar formatting in the address for most of the spam I get. It looks like 90% of my spam comes from the same organization. It’s all phishing and it’s all very annoying.

that's so many junk emails to receive I'm not sure whether to be shocked or impressed!

have you tried all the measures I've been suggesting in my posts?

in a few weeks I'm down from 20 spam a day to 1 or less,

if you genuinely have put in place every measure I suggest and are still getting the same amount of spam then there must be something else I'm doing that I've failed to mention in public, so far,

are you blocking/filtering remote content,

have you checked your account activity to see if there are numerous unsuccessful attempts to access your account from locations and with devices you don't recognise?