Attackers never needed a password: they let victims finish the login, kept the key Microsoft issued afterward, and replayed ...