O365 phishing attacks are are easy - just trick the recipient into giving up their password on a fake login page. Requiring users to authenticate with additional factors is the best way to stop the attack. Read More