Don't Approve a Microsoft Sign-In You Didn't Start: Device-Code Phishing Explained

Recent phishing campaigns are targeting Microsoft 365 users with a clever new trick: convincing them to enter a device code on the legitimate Microsoft login page. This approach lets attackers bypass multi-factor authentication (MFA) and access accounts—without ever stealing a password or using a fake login site. Understanding this scam and knowing how to respond is essential for every Microsoft 365 user.

Why This Matters to Small Businesses

Cloud collaboration tools like Microsoft 365 are central to daily business operations. When attackers find new ways to get around security controls like MFA, the risk of unauthorized access increases—potentially exposing sensitive business data, email, and files. Small businesses and nonprofits are frequent targets because attackers know that a single compromised account can lead to significant disruption.

How the Device-Code Phishing Scam Works

This phishing technique is different from most email scams. Instead of sending you to a fake login page, attackers impersonate trusted services (like file-sharing or collaboration tools) and ask you to help them "verify" or "access" a document. The message provides a device code and a link to the real Microsoft device login page (https://microsoft.com/devicelogin).

When you enter the attacker-supplied code, you are authorizing a third-party device or app—controlled by the attacker—to access your Microsoft 365 account. This process grants the attacker OAuth tokens, which can be used to access your email, files, and other resources. Critically, this method bypasses MFA because you are granting access directly, not entering your password or approving a suspicious sign-in notification.

How to Protect Yourself and Your Organization

• Never enter a device code unless you personally initiated the sign-in or device setup. If you did not start the process, do not enter the code—no matter how convincing the message looks.
• Be cautious with unexpected emails or messages, especially those claiming to share files or request urgent action. Verify requests through a separate communication channel if unsure.
• Report suspicious messages to your IT team or NIS. Quick reporting helps prevent wider exposure.
• Review your Microsoft 365 account's connected devices and apps regularly. Remove any you do not recognize.
• Continue using MFA. While this attack can bypass MFA in this specific scenario, MFA still blocks many other threats.

How NIS Helps Manage and Reduce This Risk

NIS monitors emerging phishing threats and educates users on the latest tactics targeting Microsoft 365. We help clients review account activity, manage connected apps and devices, and implement security policies that limit the risk of unauthorized access. Our team provides clear guidance and support if you receive a suspicious message or think your account may be at risk. Regular security awareness training and proactive monitoring are key parts of our managed services.

Staying alert to new phishing techniques is an important part of keeping your business secure. If you have questions about Microsoft 365 security or want to improve your organization's defenses, NIS is here to help.