Threat actors abused lack of MFA, OAuth in spam campaign