The FBI says a new phishing scam can bypass MFA by tricking users into approving legitimate Microsoft logins.