Comment by syshum

>"able to trick the Microsoft platform’s authentication"

So they social engineered the password, and if MFA was on it was push based MFA and the user just clicked OK to all popups on their phone?