My first thought on this was that it was an EvilginX hack, ala https://www.thecloudtechnologist.com/office-365s-mfa-is-vuln...