This phish typically originates from a non-Cornell email address. The sender may appear as "Howard [Surname] <[user]@skyscraperproductions.com>". The message body contains only the image shown. The message has a .eml attachment shown below which directs to a fake login page. If you entered your credentials into the page change your NetID password immediately at https://netid.cornell.edu.