FBI warns of Kali365 phishing kit that breaks into Microsoft 365 accounts – no password required

So, you've enabled multi-factor authentication. You've taught your staff never to type their passwords into dodgy-looking login pages. Surely your Microsoft 365 accounts are safe now?