05/26/2026
Pay attention to this fake “Microsoft” scam.
If an email asks you to enter a verification code on Microsoft's login page, don't enter the code.
That request is the giveaway for a phishing technique called device code phishing, which has hit over 340 organizations across the World.
What makes this attack dangerous is that it bypasses Multi-Factor Authentication entirely, even strong MFA.
The attacker is tricking you into authorizing their device into your Microsoft 365 tenant.
You get an email about a shared SharePoint document, a payroll bonus PDF, or a meeting invitation from someone who looks legitimate.
The link sends you to login.microsoftonline.com, which is the real Microsoft login page.
The page asks you to type in a short verification code that was included in the email.
You enter it and move on with your day.
But what you did was approve the attacker's device into your Microsoft 365 environment.
They now have a valid access token tied to your account.
They can read your email, download your files, and set up mailbox forwarding rules without ever needing your password again.
A turnkey phishing kit called EvilTokens started selling on Telegram in February 2026, which means even low-skill attackers can run these campaigns at scale.
Authenticator app prompts are better than nothing, but they don't protect against this specific technique.
If you don't know how to do these things, let us know and we’ll help you out.
Wapak Computer
419-273-4545
