Account Takeover from Bypassing Microsoft Authenticator without OTP