The surge in attempts to compromise Microsoft 365 accounts has been enabled by readily available phishing tools.