A new Microsoft 365 scam sneaks fake billing alerts into your calendar. No clicks needed. Here’s how to protect your account.