The attacker did not need to host a conventional phishing page. Microsoft redirects, a blob URL and a service worker assembled the fake login inside the victim’s browser.