Office 365 phishing runs real-time check of stolen domain logins

Testing logins in real-time is an unusual technique that allows the attacker to adapt their response based on the received feedback.