Microsoft disclosed a credential theft campaign targeting 35,000+ users at 13,000+ organizations across 26 countries.