[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fjJnUC23QGXO9nSWhcf7zR8gFymmWnYUfxXt6AxKDPEw":3},{"article":4,"iocs":48,"watch_terms":52,"solutions":53,"lesson":139},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"f317cb3a-8360-4471-b957-2b2349938fbb","How attackers turned a Teams meeting booking into a device code phishing trap","how-attackers-turned-a-teams-meeting-booking-into-a-device-code-phishing-trap-a964a8","Attackers used a fake Microsoft Teams meeting scheduler to trick an employee at a construction company into approving a device code sign-in. They got a valid session token before Huntress’s security operations center identified the incident. Device code phishing abuses a real Microsoft sign-in flow. The attacker starts a sign-in, gets a short code back, and persuades the victim to type it into Microsoft’s genuine device login page. The victim enters the code, completes MFA … More → The post How attackers turned a Teams meeting booking into a device code phishing trap appeared first on Help Net Security.","Attackers exploited a fake Microsoft Teams meeting scheduler to trick an employee into approving a device code sign-in, obtaining a valid session token. This method abuses Microsoft's legitimate device code sign-in flow, where victims enter a code into a Microsoft page, unknowingly granting the attacker access tokens. The phishing kit was designed to evade scanners and included fallbacks for MFA errors, with the final login routed through a residential proxy.","Attackers used a fake Teams scheduler to trick an employee into approving a device code sign-in.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F13\u002Fmicrosoft-teams-device-code-phishing\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002F12155343\u002Fmicrosoft-teams-2026.webp","2026-11-13T06:15:48+00:00","2026-11-13T08:00:19.212132+00:00",8,[17,20,23,26,28],{"name":18,"type":19},"Microsoft Teams","product",{"name":21,"type":22},"device code sign-in","technology",{"name":24,"type":25},"Microsoft","vendor",{"name":27,"type":25},"Huntress",{"name":29,"type":19},"Calendly","2c8f44d4-b56e-47cf-9677-04f22c9ee78d",{"id":30,"icon":32,"name":33,"slug":34},null,"Identity & Access","identity-access",[36,38,43],{"category":37},{"id":30,"icon":32,"name":33,"slug":34},{"category":39},{"id":40,"icon":32,"name":41,"slug":42},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49],{"type":42,"value":50,"context":51},"AES-256-GCM","Phishing kit encryption method",[24,27,18],{"controls":54,"vendors":135},[55,83,109],{"slug":56,"name":57,"problem":58,"products":59},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[60,68,75],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":69,"vendor_name":24,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"slug":84,"name":85,"problem":86,"products":87},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[88,96,104],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":69,"vendor_name":24,"vendor_logo":70,"product_slug":105,"product_name":106,"url":107,"description":108},"defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"slug":110,"name":111,"problem":112,"products":113},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[114,121,128],{"vendor_slug":115,"vendor_name":27,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":110,"product_name":125,"url":126,"description":127},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":129,"product_name":132,"url":133,"description":134},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",[136],{"slug":115,"name":27,"logo_path":116,"roles":137},[138],"reported_by",{"slug":140,"title":141,"body":142,"framework_refs":143,"framework_notes":149},"device-code-phishing-bypasses-mfa-by-abusing-legitimate-microsoft-auth-flow","Device Code Phishing Bypasses MFA by Abusing Legitimate Microsoft Auth Flow","Attackers crafted a fake Microsoft Teams meeting invitation to lure an employee into completing a device code sign-in, a legitimate Microsoft authentication flow intended for input-constrained devices. By tricking the victim into entering an attacker-controlled code on Microsoft's real authentication page, the attacker obtained a valid OAuth session token without needing the user's password or MFA code directly. This attack is particularly dangerous because the victim interacts with a genuine Microsoft domain, making it nearly impossible to detect through URL inspection alone. The use of residential proxies further obscured attacker infrastructure, complicating detection and attribution efforts.",[144,145,146,147,148],"MITRE ATT&CK T1528: Steal Application Access Token","NIS2 Article 21(2)(j)","NIS2 Article 21(2)(g)","NIST SP 800-53 IA-11: Re-authentication","CIS Control 6: Access Control Management",{"NIS2 Article 21(2)(g)":150,"NIS2 Article 21(2)(j)":151,"NIST SP 800-53 IA-11: Re-authentication":152,"CIS Control 6: Access Control Management":153,"MITRE ATT&CK T1528: Steal Application Access Token":154},"This point mandates basic cyber hygiene and security training, and the attack succeeded because the employee was not trained to recognize or refuse unexpected device code authentication prompts.","This point requires organizations to implement multi-factor authentication and secured communications; enforcing phishing-resistant MFA and restricting device code flows would have prevented the attacker from obtaining a usable session token.","This control requires re-authentication under specific conditions, and enforcing device-bound or context-aware re-authentication would have limited the attacker's ability to silently reuse the stolen session token.","This control calls for managing and restricting authentication mechanisms; disabling the device code OAuth grant for users who do not need it would have eliminated the attack vector entirely.","This technique directly describes how attackers abuse OAuth device code flows to obtain valid access tokens without credential theft, which is exactly the method used in this incident."]