A newer phishing technique is bypassing multi-factor authentication without cracking a single password — and accounting firms are a natural target.