Researchers have found it’s still child’s play to hijack subdomains from companies such as Microsoft to use in phishing and malware attacks.