A widespread and ongoing password-spraying campaign has successfully compromised dozens of Microsoft 365 accounts by exploiting misconfigured security settings, cybersecurity researchers report.