SecurityFan score 7 · Tier D
How attackers turned a Teams meeting booking into a device code phishing trap
Help Net Security · By Mirko Zorz ·
The Brief
- Attackers used a fake Microsoft Teams meeting scheduler to trick an employee at a construction company into approving a device code sign-in.
- The attackers obtained a valid session token before Huntress's security operations center identified the incident.
- The attack abuses the legitimate device code sign-in flow, so the sign-in itself looks genuine.
Why it matters
Device code phishing can yield valid session tokens without a password, so users and admins should treat unexpected device code approval requests as a serious warning sign.
Who’s affected
- Organisations using Microsoft Teams and Microsoft 365 sign-in
- Security teams monitoring for device code phishing
- #phishing
- #device-code-phishing
- #microsoft-teams
- #session-hijacking
- #social-engineering
Attackers used a fake Microsoft Teams meeting scheduler to trick an employee at a construction company into approving a device code sign-in. They got a valid session token before Huntress’s security operations center identified the incident. Device code phishing abuses a real…