New phishing-as-a-service platform steals Microsoft 365 credentials via large-scale adversary-in-the-middle attacks.