Microsoft details a new multi-stage phishing campaign that only affects victims without multifactor authentication in place.