A real Microsoft page, a real code, and a stranger in your inbox

· · Security

Someone in your accounts team gets an invitation to view a shared document. To open it, the message says, go to the Microsoft sign-in page and enter this short code. They check the address bar. It really is Microsoft. They type the code, approve the prompt on their phone, and carry on with their day.

Nothing about that looked wrong, and no password was stolen. A stranger now has their mailbox.

This is called device code phishing, and it is why a business with multi-factor authentication (MFA, the code or prompt on your phone after your password) switched on can still lose an inbox. Last week Microsoft took down the service that had made it easy.

What happened

Microsoft says it has disrupted a phishing service called EvilTokens, seizing 50 websites and more than 150 supporting domains. The Metropolitan Police arrested two men, aged 32 and 38, who have been released on bail while the investigation continues.

EvilTokens appeared in February and was rented out to criminals for $1,500 up front and $500 a month. In seven months it was used to get into more than 12,000 inboxes at more than 10,000 organisations. The UK was among the countries with the most activity, and the targets included wholesale distribution, construction, financial services, and property: ordinary firms that pay and chase invoices by email.

The part that should worry a finance director came after the break-in. The service included an AI assistant that read the stolen mailbox and picked out who approves payments, who trusts whom, and where a fake invoice would most likely be paid. In the words of Steven Masada of Microsoft's Digital Crimes Unit, the AI "helped them decide who to target, who to impersonate, and how to most effectively exploit the relationship to extract as much money as possible".

How a code lets someone in

Some devices cannot show a normal login screen: a meeting-room display, a printer, a smart TV. For those, Microsoft offers a different way to sign in. The device shows a short code, you open a browser on your phone or laptop, enter the code on a Microsoft page, and approve it. The device is then signed in as you.

The attack turns that around. The criminal starts the sign-in on their own computer, gets the code, and sends it to you dressed up as a meeting invite or a document link. You enter it on the genuine page and complete the MFA check yourself. Their computer is the "device" that gets signed in.

That is why the usual advice fails here. The web address is correct. The page is real. MFA worked exactly as designed. As Malwarebytes puts it, the question to ask is whether the code appeared on a device you were trying to sign in to, or whether somebody sent it to you.

Taking down one service does not remove the technique. Other phishing kits do the same thing.

The fix is a setting, not a training course

Most small businesses never use this way of signing in. If nothing in your office needs it, it can be turned off for everyone.

Microsoft's own analysis of EvilTokens recommends "blocking device code flow wherever possible". The tool for doing it is Conditional Access, the part of Microsoft 365 that sets rules for who can sign in and how. Microsoft says Conditional Access needs an Entra ID P1 licence, and that Microsoft 365 Business Premium customers can use it too. If you are on Business Basic or Business Standard, you do not have it, and that is worth knowing before you ask.

What to do

  • Ask one question of whoever runs your Microsoft 365. "Is device code sign-in blocked for our users?" It is a yes or no answer.
  • If you run it yourself, check before you block. Microsoft publishes a step-by-step policy and suggests running it in report-only mode first, so you can see whether anything legitimate (a Teams room device, an old script) still depends on the feature. Allow those specifically and block everyone else.
  • Give staff one rule. Never enter a sign-in code that someone sent you. A real code appears on the device you are setting up, in front of you.
  • Know what a compromise looks like. Microsoft saw attackers create hidden inbox rules and register a new device against the account within ten minutes. Unexpected rules that move or delete mail are the sign to look for.
  • If it happens, a password change is not enough. Microsoft found that revoking sessions can leave the attacker's access working for up to an hour, and recommends temporarily disabling the account. Do that first, then tidy up.
  • Keep the payment rule you already have. Any change of bank details gets confirmed by phone, on a number you already hold. That stops the fraud even when the mailbox is lost.

How Steelwise can help

Checking how your Microsoft 365 sign-in is really configured, including the routes that MFA does not cover, is a short and specific piece of security advisory work. Get in touch if you would like a second pair of eyes on it.

Further reading

← All filings

We use cookies to understand how visitors use this site. More information.