In April one of our timber buyers received an email from the sales manager of a sawmill we have bought from for years. It came from his real address and continued a real conversation about summer prices. It said he had set up a Teams call to go through the new price list, and that to join she should go to a Microsoft address and enter a code, which was in the email.
She checked the link before she clicked it, as we have taught everybody to do. It was microsoft.com/devicelogin, a genuine Microsoft page. She typed the code, signed in with her password and approved the prompt on her phone. Nothing seemed to happen, and she assumed the call had not started yet.
That page exists for devices without a proper keyboard, such as a meeting room screen or a smart television. The device shows a short code, you type it on your phone or laptop and sign in there, and the device is given access to your account. Nothing in the process checks that the device asking is the one in front of you. The code in the email had been generated a few minutes earlier by the attacker, so when she signed in, she signed in his computer. It received access to her mailbox, her files and Teams, and her second factor had approved it. The sawmill manager's mailbox had been taken over the same way the week before.
Over the next day the attacker read her mail and sent the same invitation to forty one of her contacts, customers and suppliers among them. A haulier rang us to ask whether the meeting was real, and that is how we found out. Her sign in history showed one entry with device code as the method, from an address abroad, at the minute she had typed the code.
We revoked every session on her account, reset her password, removed an inbox rule the attacker had added to hide replies, and warned every contact on the list. Then we looked at who in the company had ever signed in this way for a genuine reason. In a year it was eleven meeting room displays and two engineers using command line tools. A Conditional Access policy now blocks device code sign in for everyone else, and those exceptions are named and reviewed. Our phishing guidance gained one line: a genuine meeting or document will never ask you to type in a code that somebody sent you.
Microsoft had published a warning about campaigns using exactly this method in February 2025. We had read it and filed it under somebody else's problem, because our people were trained to check the address, and here the address was real.
A real sign in page proves only that you are signing in. It does not tell you who you are signing in for. Switch off the ways of signing in that you do not use, because each one is a door that needs only one person to open it.
– Serguey Shinder
Top comments (1)
The 15 minute lifetime of a device code explains the lure: the attacker has to get it typed while it is still valid, so it almost always arrives as a call that is about to start. The rule we give people is short: a real device code appears on the screen in front of you, and a code that comes by email or chat was made by someone else.