I'd contest the sophisticated characterisation. Phishing activity targeting banking has been doing this for ages and it's been common against office365 accounts

I'd contest the sophisticated characterisation. Phishing activity targeting banking has been doing this for ages and it's been common against office365 accounts for a long time as well. And it's plainly obvious to common sense that the adversary can just proxy the verification code check in a phishing attack.