New attack technique uses Office 365 APIs to cross-check credentials against Azure Active Directory as victim types them in.