Blog

The Teams invite that hands over your account, no password needed: device code phishing explained

26 October 2026 · 2 min read

Most phishing tries to steal your password on a fake page. Device code phishing is sneakier: everything you see is real, including the Microsoft sign-in page. You just end up signing in for the attacker.

In February 2025 Microsoft described a group it tracks as Storm-2372 using this technique against governments, NGOs, IT, telecom, health, education and energy organizations in Europe, North America, Africa and the Middle East. In a July 2026 update Microsoft linked the group to Midnight Blizzard. But the technique works just as well against a small nonprofit or a local business.

How it works

Some devices, like smart TVs or printers, can't show a full sign-in page, so Microsoft lets them display a short code that you type into a real Microsoft page on your phone or computer. That's the "device code flow".

The attack abuses it:

1. The attacker starts a sign-in on their own machine and gets a genuine code from Microsoft.
2. They send you a message, often posing as someone important, with a fake Teams meeting invite (Microsoft also saw WhatsApp and Signal lures) that asks you to enter the code to join.
3. You go to the real Microsoft page, type the code and sign in.
4. Microsoft hands the attacker's machine a valid session. They can now read your mail and files. No password was stolen, so a password change alone doesn't kick them out.

Microsoft later saw the group use the same trick to register their own device in the victim's organization, giving them longer-lasting access.

The habit

Only enter a device code if you started the sign-in yourself, on a device in front of you. A meeting invite, an email or a chat message never needs you to type a code into a Microsoft page.

The settings (for whoever manages Microsoft 365)

Microsoft's recommendations include:

• block device code flow wherever it isn't needed, using Conditional Access;
• require multifactor authentication, ideally phishing-resistant methods such as passkeys or security keys;
• if you suspect this happened, revoke the user's sessions (refresh tokens), not just their password;
• limit who can register devices in Entra ID;
• use sign-in risk policies to respond automatically to risky sign-ins.

Where KnoxDefender helps

The first contact usually arrives by email: a "meeting invite" from someone who isn't who they claim. KnoxDefender flags impersonation and outside senders using a colleague's name, adds a CAUTION banner to outside mail if you turn it on, and its "OAuth consent scams" and "Responding to a suspected mailbox compromise" courses cover the sign-in tricks around it. Mailbox takeover alerts (new forwarding rules, unusual sign-ins) are part of KnoxDefender too and switch on once our Microsoft verification is complete.

Source

• Microsoft Threat Intelligence: Storm-2372 conducts device code phishing campaign (13 February 2025, updated 14 February 2025 and 31 July 2026)

← All stories · Questions? Contact us.