Microsoft has uncovered Kremlin-backed nation-state activity exploiting a critical security flaw in Outlook, putting victims' accounts at risk.