A single click on a Microsoft link could have drained your inbox. Here’s how SearchLeak worked. — Blankdot