A New Phishing Scam Is Bypassing Passwords — Here’s What You Need to Know

Just When You Thought You Had Cyber Security Under Control…

Have you ever felt like just when your business finally has its cyber security locked down — bam! — something new comes along to throw a wrench in the works?

Unfortunately, that’s exactly what’s happening now.

A new type of scam is making the rounds, and it’s catching out businesses like yours. The worst part? Cyber criminals don’t even need your password anymore.

---

What Is Device Code Phishing?

This new attack is called device code phishing, and it’s rapidly gaining popularity. Microsoft has already flagged a surge in these types of attacks, and we’re likely to see more.

Unlike traditional phishing – where scammers trick people into entering passwords on fake login pages – device code phishing is more devious. It uses real Microsoft login pages, which makes it much harder to detect.

---

How the Scam Works

1. It starts with a legitimate-looking email — maybe from someone posing as HR or a colleague — inviting you to a Teams meeting or prompting a login.
2. You click the link, and you’re taken to a genuine Microsoft login screen.
3. The email also includes a “device code” and instructions to enter it.

Seems harmless, right?

Here’s the trick: Entering that code gives the attacker access to your Microsoft account — on their device.

You’re not logging yourself in… you’re logging them in.

---

Why It’s So Dangerous

• It bypasses passwords and MFA: Because you’re voluntarily initiating the session and using official Microsoft tools, even multi-factor authentication may not stop it.
• It looks completely legitimate: No fake websites. No odd URLs. It all happens on real Microsoft domains.
• It can be invisible to security tools: Since the process uses approved login flows, traditional detection tools may not flag it.
• It may persist after password changes: If the attacker captures your session token, they can stay logged in even if you update your password.

---

What Can Attackers Do Once They’re In?

Once access is granted, attackers can:

• Read and send emails using your identity
• Access or delete files in OneDrive or SharePoint
• Launch internal phishing attacks using your account
• Steal sensitive company data
• Set up long-term persistence in your systems

It’s like giving away the keys to your office — without even realising it.

---

How to Protect Your Business from Device Code Phishing

1. Train Your Team to Be Suspicious of Code-Based Logins

Encourage your staff to ask questions like:

• Did I request this code?
• Am I expecting a login prompt?
• Do I know this person actually sent this?

If anything feels off, verify the request through a separate method like a direct message or phone call. Never enter a code someone else has given you without confirming it’s legitimate.

---

2. Disable Unnecessary Features

If your business doesn’t rely on device code logins, your IT team or provider should disable it at the tenant level. This eliminates a major entry point for attackers.

---

3. Implement Conditional Access Policies

Advanced security tools in Microsoft 365 allow you to restrict logins based on:

• Trusted device status
• Geographic location
• IP address
• Risk detection from Microsoft’s cloud intelligence

These policies can help block suspicious login attempts, even if credentials are compromised.

---

4. Ongoing Cyber Security Awareness Training

Most breaches happen because someone didn’t realise they were being tricked. Regular training and simulated phishing exercises can help your team stay sharp and spot red flags before damage is done.

---

Need Help Locking Down Your Microsoft Environment?

We help businesses like yours take control of their cyber security — without the jargon or complexity.

If you want a review of your setup or help implementing stronger protections, get in touch today.