Anatomy of an Active Microsoft 365 Phishing Kit

An employee opens a shared-document notification, signs in, and completes MFA. A few minutes later, someone else is reading their inbox. The login worked. So did the trap. Microsoft 365 phishing kits are built around that uncomfortable possibility. Some proxy a…