10/06/2026
This one's a bit of a head-scratcher. So bear with me.
There's a phishing attack doing the rounds that bypasses MFA. Even the strong stuff.
It's called device code phishing and it's hit over 340 organisations across the US, Canada, and Europe since February. A ready-made kit to run it started selling on Telegram earlier this year, which means you don't need to be particularly clever to pull it off.
Here's how it works.
You get an email. Looks legitimate. Could be a shared SharePoint document, a payroll PDF, a meeting invite. The link takes you to login.microsoftonline.com — the actual Microsoft login page, not a fake one.
The page asks you to type in a short verification code that was in the email.
You do it. Move on with your day.
Turns out you just approved the attacker's device into your Microsoft 365 account. They now have a valid access token. They can read your emails, download your files, and set up forwarding rules. No password needed. Ever again.
The reason MFA doesn't save you here is that you're the one doing the authorising. You just didn't know it.
A few things that actually help:
1) Block device code authentication flow in Entra ID for anyone who doesn't need it. Most office staff don't. Go into Conditional Access and create a policy that blocks it by default.
2) Train your team on one simple rule: Microsoft will never email you a verification code to enter on its login page. If that happens, it's phishing. Full stop. Doesn't matter how legitimate the sender looks.
3) Where you can, switch to phishing-resistant MFA. FIDO2 hardware keys or Windows Hello for Business. Authenticator app prompts are better than nothing but they won't stop this specific attack.
Not sure how to set any of this up? Give me a shout and we'll sort it.
