The phishing-as-a-service toolkit leverages legitimate authentication to capture tokens and access Microsoft 365 services.