Device Code Phishing via Teams: How Attackers Are Bypassing MFA

Help Net Security has reported on an incident in which attackers used a fake Microsoft Teams meeting scheduling link to deliver a device code phishing attack against an employee at a construction company. The attacker initiated a legitimate Microsoft device code sign-in flow, obtained a short authentication code, and then persuaded the victim to enter it into Microsoft's genuine device login page. The victim completed multi-factor authentication as part of this process, believing they were authenticating normally — but in doing so, they handed the attacker a valid session token. Huntress's security operations centre identified the incident before significant damage occurred, but the attacker had already obtained authenticated access to the target's Microsoft environment.

Why this matters for UK organisations

Device code phishing is a technique that abuses a real and legitimate Microsoft authentication flow, originally designed to allow sign-in on devices without a browser, such as smart TVs or printers. Because the victim interacts with genuine Microsoft pages and completes a real MFA prompt, the attack is difficult to identify as suspicious through standard user awareness alone. This technique is increasingly being used against organisations that have deployed MFA, precisely because it sidesteps the protection MFA is intended to provide — the attacker does not need the victim's password, and the MFA completion itself authorises the attacker's session.

The use of a fake Teams meeting invitation as the lure is also notable. Construction, professional services and project-based industries receive high volumes of external meeting requests, making a scheduling link a plausible and low-suspicion delivery mechanism. This reflects a broader pattern in which attackers tailor their lures to the working habits of their target sector.

What to review

UK businesses should review whether their security awareness training covers device code phishing specifically, including helping staff understand that completing an MFA prompt is not always a safe action if the request was not initiated by the user themselves. On the technical side, it is worth reviewing whether your Microsoft tenant has Conditional Access policies configured to restrict or block device code authentication flows for users who do not require them. Microsoft provides controls that can significantly limit exposure to this technique, and reviewing whether those controls are in place is a practical and proportionate step for most organisations.

Source: Help Net Security