For Businesses & IT Teams Device Code Phishing: The Microsoft 365 Attack That Walks Past MFA Published June 29, 2026 · 11 min read · By the ScamDrill Team Share Facebook LinkedIn Post Email Copy link Bottom line up front Device code phishing is the rare account takeover that needs no password and breaks no multi-factor authentication. Your employee does the signing in, on the real Microsoft page, after an attacker hands them a short code. When they enter it, they authorize the attacker's device instead of their own, and the company's email, Teams, and files open up with no second prompt. The fix is not a stronger password or more MFA. It is switching off the login flow that makes the trick possible, and teaching one reflex: a code you didn't ask for is not a login. The email looks like a document share, a Teams invite, or a note from a vendor you actually do business with. It reads cleanly, because a machine wrote it for this exact recipient. Your employee clicks, lands on a page that says “to verify your identity, enter this code at microsoft.com/devicelogin,” and does as it asks. The page they end up on is genuinely Microsoft’s. The sign-in is real. The MFA prompt is real. Everything works the way it is supposed to, which turns out to be the entire problem. A few minutes later, someone in another country is reading that mailbox. No password was stolen. No one-time code was intercepted. The FBI put out a public warning about this in a May 2026 alert , after a subscription kit called Kali365 turned the technique into something a low-skill buyer could rent and run. The same method, in more careful hands, has been used by a Russia-aligned espionage group since 2024. It is one of the cleaner ways into a Microsoft 365 tenant right now, and most of the defenses companies have invested in do not see it coming. Five signs a “verify your identity” request is really an attack Whether you are an employee or the person who runs the tenant, the tells are the same. If a sign-in request does any of the following, stop and treat it as hostile: You’re asked to enter a code you didn’t request. A real device-code login starts on a device you are holding, like a conference-room display or a printer. If a code arrives by email or chat, you didn’t start it, so someone else did. The code came in an email, attachment, or chat link. Microsoft does not email you a code to paste into a login page. The delivery method is the giveaway. The page is rushing you. A visible countdown, a “this expires in 15 minutes,” or a code that has already been copied to your clipboard are all pressure, not service. The sender is plausible but the ask is odd. A vendor, an invoice, an RFP, a shared file, anything that ends in “sign in to view” and routes you through a Microsoft login you didn’t expect. After you sign in, nothing opens. You “verified,” and the promised document never appears, because the only thing that needed your login was the attacker’s waiting session. Any one of these is enough to walk away. In a real lure you will usually see several at once. Definition Device code phishing: an attack that abuses Microsoft’s legitimate device-code login flow, the one built for TVs and printers, by getting a target to enter an attacker-generated code on the real Microsoft sign-in page. The victim completes the login and MFA and unknowingly hands the attacker valid access and refresh tokens. Why this matters: almost every phishing defense an organization buys is built to catch a stolen password or a fake login page. Device code phishing trips none of those wires. There is no spoofed site to block, no password to leak, and no MFA prompt to fail, because the employee authenticates on the genuine Microsoft page and the token that comes out the other side is routed to the attacker. Microsoft has been direct about this in its own writeups: the technique does not reflect a flaw in its code . It abuses a standard that is working exactly as designed. 340+ Microsoft 365 organizations across five countries, the U.S., Canada, Australia, New Zealand, and Germany, hit by a single device code phishing campaign first spotted in February 2026, with cases accelerating from there. Source: Huntress research, via The Hacker News and the Cloud Security Alliance, March 2026. How the attack actually works Once you see the sequence laid out, the strangeness of it makes sense: the victim is a participant, not a bystander. The FBI describes the chain in four moves, and Microsoft’s threat researchers fill in the mechanics. Here is the combined picture. Figure 01 · Anatomy of a device code phishing attack Scam Drill 1 The lure An AI-written email, posing as a document share, Teams invite, or vendor note, tuned to the target's job. 2 The handoff A code, and a link to the real microsoft.com/devicelogin. Newer kits mint the code the instant the victim clicks. 3 The sign-in The user logs in and clears MFA, authorizing the attacker's device instead of their own. 4 The token theft Th...