New Microsoft 365 Phishing Scam Bypasses MFA

Cybersecurity threatsare evolving faster than ever. A new phishing scam is targeting small and mid-sized businesses using Microsoft 365. It's called device code phishing, and it allows cybercriminals to gain access to your accounts—without needing your password.

Even if your team uses multi-factor authentication (MFA), this scam can slip through. Here's what you need to know to stay protected.

What Is Device Code Phishing?

Unlike traditional phishing scams, which lure users into entering passwords on fake websites, device code phishing uses legitimate Microsoft login portals to trick users into granting account access.

It starts with a professional-looking email—perhaps appearing to come from your HR department or a coworker—inviting you to join a Microsoft Teams meeting or access a shared file. The email includes a short “device code” and a link to a real Microsoft login page.

You enter the code. But instead of logging yourself in, you’re authorizing the attacker’s device to access your Microsoft 365 account.

This phishing technique is especially dangerous because:

• It uses official Microsoft login screens

• It bypasses MFA

• It looks completely legitimate to both users and many security tools

Why It's a Serious Cybersecurity Threat

Once inside your account, attackers can:

• Access sensitive business emails and client data

• Spread malware or ransomware

• Launch business email compromise (BEC) attacks on your coworkers or vendors

• Steal Microsoft 365 session tokens, allowing them to stay logged in even if you change your password

Because the login happens through an approved Microsoft flow, many traditional email filters and endpoint protection tools miss the threat altogether.

How to Protect Your Business from Microsoft 365 Phishing Scams

1. Train your employees on phishing awareness
   Include device code phishing in your cybersecurity training. Remind staff to never enter a code they didn’t request themselves.

2. Use internal verification methods
   If you receive an unexpected code or login request, use company messaging tools or a direct phone call to verify.

3. Disable device code flow if not required.
   If your business doesn’t rely on device code authentication, your IT provider can disable it and reduce risk exposure.

4. Enforce Conditional Access policies in Microsoft 365
   Use Azure AD Conditional Access to limit login activity by device, location, or risk level.

5. Perform regular Microsoft 365 security audits
   Ensure you’re using the latest identity protection and zero-trust security policies to block unauthorized access.

Need Help Locking Down Your Microsoft 365 Environment?

Protect your business from the latest cybersecurity threats, including emerging phishing scams like this one.

We offer a free Microsoft 365 security review to:

• Identify vulnerabilities

• Strengthen your authentication methods

• Help you prevent phishing attacks and email compromise

Don’t wait until a scam exposes your data or reputation.