Microsoft 365 tenants faced ATO attempts by late 2024, with attackers using HTTP clients like Axios and Node Fetch.