06/09/2026
Pay attention to this fake “Microsoft” scam.
If an email asks you to enter a verification code on Microsoft's login page, don't enter the code.
That request is the giveaway for a phishing technique called device code phishing, which has hit over 340 organizations across the US, Canada, and Europe since February.
What makes this attack dangerous is that it bypasses Multi-Factor Authentication entirely, even strong MFA.
The attacker is tricking you into authorizing their device into your Microsoft 365 tenant.
You get an email about a shared SharePoint document, a payroll bonus PDF, or a meeting invitation from someone who looks legitimate.
The link sends you to login.microsoftonline.com, which is the real Microsoft login page.
The page asks you to type in a short verification code that was included in the email. You enter it and move on with your day.
But what you did was approve the attacker's device into your Microsoft 365 environment.
They now have a valid access token tied to your account.
They can read your email, download your files, and set up mailbox forwarding rules without ever needing your password again.
A turnkey phishing kit called EvilTokens started selling on Telegram in February 2026, which means even low-skill attackers can run these campaigns at scale.
To shut this attack down inside your business:
▶️ Block device code authentication flow in Entra ID for users who don't need it.
This protocol was designed for devices with lim
