Hackers are spoofing popular cloud and productivity apps to steal people’s Microsoft 365 login credentials and deliver malware, experts have warned.