06/10/2026
๐๐๐ฒ ๐๐ญ๐ญ๐๐ง๐ญ๐ข๐จ๐ง ๐ญ๐จ ๐ญ๐ก๐ข๐ฌ ๐๐๐ค๐ โ๐๐ข๐๐ซ๐จ๐ฌ๐จ๐๐ญโ ๐ฌ๐๐๐ฆ.
If an email asks you to enter a verification code on Microsoft's login page, don't enter the code.
That request is the giveaway for a phishing technique called device code phishing, which has hit over 340 organizations across the US, Canada, and Europe since February.
What makes this attack dangerous is that it bypasses Multi-Factor Authentication entirely, even strong MFA. The attacker is tricking you into authorizing their device into your Microsoft 365 tenant.
You get an email about a shared SharePoint document, a payroll bonus PDF, or a meeting invitation from someone who looks legitimate. The link sends you to login.microsoftonline.com, which is the real Microsoft login page.
The page asks you to type in a short verification code that was included in the email. You enter it and move on with your day. But what you did was approve the attacker's device into your Microsoft 365 environment. They now have a valid access token tied to your account.
They can read your email, download your files, and set up mailbox forwarding rules without ever needing your password again.
A turnkey phishing kit called EvilTokens started selling on Telegram in February 2026, which means even low-skill attackers can run these campaigns at scale.
๐๐จ ๐ฌ๐ก๐ฎ๐ญ ๐ญ๐ก๐ข๐ฌ ๐๐ญ๐ญ๐๐๐ค ๐๐จ๐ฐ๐ง ๐ข๐ง๐ฌ๐ข๐๐ ๐ฒ๐จ๐ฎ๐ซ ๐๐ฎ๐ฌ๐ข๐ง๐๐ฌ๐ฌ:
โก๏ธ Block device code authentication flow in Entra ID for users who don't need it. This protocol was designed for devices with limited input, which most office staff don't use. Open Conditional Access and create a policy that blocks device code flow by default.
โก๏ธ Train your team. Microsoft will never email you a verification code to enter on its login page. If a user gets an email instructing them to enter a code into login.microsoftonline.com, the email is phishing, no matter how legitimate the sender looks.
โก๏ธ Use phishing-resistant MFA where possible, like FIDO2 hardware keys or Windows Hello for Business. Authenticator app prompts are better than nothing, but they don't protect against this specific technique.
If you don't know how to do these things, let us know and weโll help you out.