You get an invitation to a Teams meeting or an online event. To join, you're asked to type a code into a Microsoft page. The page is the real one, with the right address and the padlock, and the code works. Nothing odd happens afterwards. But you've just given a stranger access to your email, your files and your Teams, without them ever touching your password and without two-step verification getting in their way.

◢What is device code sign-in?

The mechanism is an open standard, not something unique to Microsoft. But the cases documented by Microsoft and the FBI target Microsoft 365 accounts, which makes sense: one employee's account opens their email, their files and their Teams all at once.

◢How does device code phishing work?

1. ▹The attacker requests a real code from Microsoft on their own machine.
2. ▹They send it to you disguised as something else, for example as the ID of a Teams meeting.
3. ▹You type it into the genuine Microsoft page and sign in as usual, second factor included.
4. ▹Microsoft hands the permissions to the attacker's machine, which can now get into your account.

Microsoft stresses that there's no flaw in its code: the technique abuses a standard mechanism that works exactly as designed. That's why the usual advice ("check the page address carefully") doesn't help here. The address is correct.

◢Why doesn't two-step verification stop it?

Because you're the one completing it. The attacker doesn't need your password or the code on your phone: they wait for you to use them and keep the result. The FBI puts it plainly in its alert: the attacker reaches services such as Outlook, Teams and OneDrive "without needing a password or completing any additional MFA challenges".

The access also lasts. Microsoft explains that the attacker stays in for as long as the tokens remain valid, which is why it recommends revoking them as soon as you suspect someone has fallen for it.

◢What lures do attackers use?

The documented cases look a lot like ordinary work email:

• ▹Teams meeting invitations sent by email, where the code appears as the "meeting ID". That's the Storm-2372 case, a campaign active since August 2024.
• ▹Messages that mimic WhatsApp, Signal or Teams, sent after winning the victim's trust by posing as someone relevant to them.
• ▹Invitations to online events or meetings that lead to a screen asking for the code.
• ▹Emails impersonating cloud productivity and document-sharing services, like the ones the FBI describes for Kali365.

The two cases need some context. Microsoft assesses with moderate confidence that Storm-2372 aligns with Russian interests, and its targets were mainly governments, NGOs, tech firms, defense, telecoms, healthcare, universities and energy. Kali365 is a different thing: phishing as a service, which according to the FBI puts the technique within reach of less technical attackers. With a kit like that, the trick no longer depends on a well-resourced group and can reach any company that uses Microsoft 365.

◢What does the attacker do once inside?

In the campaign Microsoft analysed, the attacker searched the mailbox for words like "password", "admin" or "credentials" and took those emails. They also used the hijacked account to send the same lure to other people in the organization, who now received it from a trusted address.

It's easy to picture this in an ordinary company: with the mailbox of someone in accounts, an attacker can read pending invoices and ask a supplier to change bank details. It's exactly the kind of access people preparing CEO fraud look for: watch the mailbox and strike at the right moment.

◢What companies can do to prevent it

In practice:

◢What employees need to know

The rule for any employee is simple: never type a code into a Microsoft page unless it was shown by a device in front of you that you're setting up yourself. No legitimate meeting, document or event needs you to type a code into Microsoft's sign-in page to open it.

If someone asks you to do it by email, on WhatsApp or in the middle of a conversation, stop and tell whoever handles IT. And if you've already done it, say so as soon as possible. There's nothing to be embarrassed about: the page was genuine and the trick is designed so that anyone can fall for it. The same habits I go through in how to spot a phishing email help you get suspicious in time.

◢A trick you can't see in the address bar

For years we've taught people to check the page address before typing anything. This attack sidesteps that advice, so it has to be explained specifically, with examples people recognise. That's exactly what I work on in my cybersecurity training for teams: making sure everyone knows what they might be asked for and what they should never do, even when the page looks trustworthy.