Device Code Phishing Campaign Targets Microsoft Users via Social Engineering

• •Attackers disguise device code phishing as Microsoft Teams meeting scheduling.
• •Victims unknowingly authorize attacker sessions by logging in via a fake site.
• •The campaign reflects a growing trend in sophisticated phishing techniques.

A new device code phishing campaign has been reported, leveraging social engineering tactics to disguise the attack as a Microsoft Teams meeting booking process. Attackers send spear-phishing emails that lead victims to a fake site mimicking the legitimate Microsoft Teams workflow. Once on the site, victims unknowingly initiate a device code sign-in request, which allows attackers to capture access tokens when victims log into their accounts. This method has evolved from traditional phishing tactics, making it harder for users to detect the threat. The campaign has been tracked by Huntress and follows a rise in device code phishing incidents since August 2024. Microsoft has previously disclosed similar campaigns, indicating a growing trend in the exploitation of device authorization flows. The attack highlights the need for increased awareness and training regarding phishing tactics among users.