Attackers use fake Teams meeting booking to trigger device code phishing

Tier D · Background noise – Good to know

Who’s exposed: Users tricked by fake Teams meeting booking; one construction company reported

Tier D because: Does not hit tech teams

Reach

Attack

Damage

Fix

Exploited in the wild · Full takeover · Secrets exposed

The Brief

Attackers used a fake Microsoft Teams meeting scheduler to trick an employee at a construction company into approving a device code sign-in.
The attackers obtained a valid session token before Huntress's security operations center identified the incident.
The attack abuses the legitimate device code sign-in flow, so the sign-in itself looks genuine.

Why it matters

Device code phishing can yield valid session tokens without a password, so users and admins should treat unexpected device code approval requests as a serious warning sign.

The checklist behind the tier

Checklist · 3 of 10 yes

No	Hits tech teams	Judgment: Teams is enterprise SaaS, but this is a phishing campaign and Teams itself was not breached.
No	Core infrastructure	Judgment: a single vendor product abused via phishing, not core infrastructure compromise.
No	Popular tool	Judgment: Microsoft Teams is popular, but only its brand is impersonated and users are phished.
Yes	Exploited in the wild	Help Net Security: attackers tricked a construction company employee and obtained a valid session token.
No	Public exploit	Help Net Security describes the phishing technique; no source says exploit code or PoC is published.
No	Remote, no login	Help Net Security: the victim had to approve a device code sign-in, requiring user interaction.
Yes	Full takeover	Help Net Security: attackers got a valid session token after the employee approved the sign-in.
Yes	Secrets exposed	Help Net Security: attackers obtained a valid session token, a credential, from the employee's account.
No	Supply chain	Help Net Security: phishing lure used a fake scheduler; no legitimate package or update was compromised.
No	No fix yet	Help Net Security describes device code phishing abuse; this is a campaign, not a patchable vulnerability.

Source

How attackers turned a Teams meeting booking into a device code phishing trap ↗ Help Net Security · 1h ago

First seen 1h ago · 1 source · Full story page · How tiers are decided