10/06/2026
Pay attention to this fake “Microsoft” scam.
If an email asks you to enter a verification code on Microsoft's login page, don't enter the code.
That request is the giveaway for a phishing technique called device code phishing, which has hit over 340 organizations across the US, Canada, and Europe since February.
What makes this attack dangerous is that it bypasses Multi-Factor Authentication entirely, even strong MFA.
The attacker is tricking you into authorizing their device into your Microsoft 365 tenant.
You get an email about a shared SharePoint document, a payroll bonus PDF, or a meeting invitation from someone who looks legitimate.
The link sends you to login.microsoftonline.com, which is the real Microsoft login page.
The page asks you to type in a short verification code that was included in the email. You enter it and move on with your day.
But what you did was approve the attacker's device into your Microsoft 365 environment.
They now have a valid access token tied to your account.
They can read your email, download your files, and set up mailbox forwarding rules without ever needing your password again.
A turnkey phishing kit called EvilTokens started selling on Telegram in February 2026, which means even low-skill attackers can run these campaigns at scale.
To shut this attack down inside your business:
▶️ Block device code authentication flow in Entra ID for users who don't need it.
This protocol was designed for devices with limited input, which most office staff don't use. Open Conditional Access and create a policy that blocks device code flow by default.
▶️ Train your team. Microsoft will never email you a verification code to enter on its login page.
If a user gets an email instructing them to enter a code into login.microsoftonline.com, the email is phishing, no matter how legitimate the sender looks.
▶️ Use phishing-resistant MFA where possible, like FIDO2 hardware keys or Windows Hello for Business.
Authenticator app prompts are better than nothing, but they don't protect against this specific technique.
If you don't know how to do these things, let us know and we’ll help you out.
