Just when you think your cyber security is rock solid, a new threat pops up to challenge everything.
Right now, there’s a growing scam that’s putting businesses like yours at serious risk. And the most alarming part? Cyber criminals can gain access to your Microsoft account – without ever needing your password.
Yes, really.
It’s called device code phishing, and it’s catching even the most careful users off guard. Microsoft has issued a warning about the rise in these attacks, and the threat isn’t going away any time soon.
So, how does it work?
Unlike traditional phishing, where attackers trick you into entering your login details on a fake site, this scam uses a more sophisticated approach. It doesn’t ask you to hand over your credentials. Instead, it uses genuine Microsoft login pages to gain access, which makes it much harder to spot.
Here’s the typical setup:
You receive an email that looks completely legitimate. It might pretend to be from a colleague, HR, or even a Microsoft Teams invite. When you click the link, it takes you to a real Microsoft sign-in page.
Everything looks normal. You’re then prompted to enter a short device code (provided in the email) to “verify” yourself or join the meeting.
But here’s the trick: That code doesn’t log you in. It logs them in.
By entering it, you unknowingly authorise the attacker’s device to access your Microsoft account. And because it all happens through Microsoft’s legitimate systems, this can even bypass multi-factor authentication (MFA).
What happens once they’re in?
Plenty. They can read your emails, browse your files, and impersonate you to target others in your organisation. All of it without triggering typical security alerts, because the login seems genuine.
Even worse, attackers can potentially stay logged in using something called a session token – a digital pass that keeps a user signed in. So changing your password after the fact might not even lock them out.
How do you protect your business?
Start with awareness. Teach your team to question unexpected login prompts, especially those involving device codes. If you receive one, ask yourself:
- Was this code expected?
- Did I initiate this request?
- Does it make sense in context?
When in doubt, verify through another channel, like calling the sender or using your internal communication tools. Don’t take emails at face value, even if they look polished and professional.
From a technical perspective, your IT provider can disable device code logins if your business doesn’t rely on them. You can also set stricter rules to only allow logins from trusted devices or locations.
And most importantly, keep security training ongoing. The more your team understands these tactics, the better they’ll be at spotting red flags.
