Recent phishing campaigns are targeting Microsoft 365 users with a clever new trick: convincing them to enter a device code on the legitimate Microsoft login page. This approach lets attackers bypass multi-factor authentication (MFA) and access accounts—without ever stealing a password or using a fake login site. Understanding this scam and knowing how to respond is essential for every Microsoft 365 user.