Phishers now weaponize genuine Microsoft sign-in pages, defeating traditional fake-login detection training. Fake Teams HR lures trick users into granting app access, bypassing password theft.