The atatckers shared a link to what appeared to be a Microsoft document, prompting the victim to log in. Obviously, the login page was bogus, and the login credentials were relayed to the attackers instead.

Yeah, well, train your used to log into Microsoft several times a day because they keep getting kicked out, what do you expect to happen.