Fake Teams Invites Are Tricking Microsoft 365 Users Into Handing Over Their Accounts

Key points

• A phishing campaign ran from the last week of June 2026 into early July, abusing Microsoft's device code sign-in flow to hijack Microsoft 365 accounts.
• Researchers at ZeroBEC say the attackers used collaboration-themed emails, not fake Microsoft login pages, to lure victims.
• Victims were sent to the real Microsoft device login page and asked to type in a code the attackers controlled.
• Once the code was entered, the attackers received working session tokens for the victim's Microsoft 365 account.
• Multi-factor authentication doesn't block this technique on its own, because the user is signing in on the genuine Microsoft site.

A new phishing campaign is quietly emptying out Microsoft 365 mailboxes without ever showing victims a fake login page.

Security firm ZeroBEC says the operation ran from the final week of June 2026 into early July. The attackers dressed their emails as ordinary work invitations: shared documents, meeting requests, team collaboration prompts. Nothing that screamed scam.

How does the scam actually work?

The attackers abuse a real Microsoft feature called the device code flow, designed for signing in on gadgets without a proper keyboard, like a smart TV or a printer. You type a short code into a Microsoft page on your phone or laptop, and the device being set up gets logged in.

In this campaign, the attackers start that sign-in process on their own machine. Microsoft hands them a short code. They then email that code to the victim, wrapped in a message that looks like a normal work invite.

The victim clicks through and lands on the genuine Microsoft device login page at microsoft.com. Everything looks legitimate. So they type in the code, sign in with their password, and approve any multi-factor prompt.

At that moment, Microsoft issues a valid session token, and it goes to the attacker's device, not the victim's.

"The campaign did not depend on a fake Microsoft password page," ZeroBEC noted in its writeup, first reported by The Hacker News. "It used a malicious collaboration-style lure to push users into the legitimate Microsoft device login experience."

Why is this harder to stop than normal phishing?

Most anti-phishing advice tells people to check the web address. Here, the address is correct, the site is Microsoft's, and password managers will happily autofill because the domain is legitimate.

Multi-factor authentication doesn't save the user either. They approve the login themselves, believing they're signing into a shared document. It's the same problem our 3 July story on the 81-million-attempt password spray exposed: MFA stops plenty of attacks, but not when the victim completes the authentication flow voluntarily.

Once the attackers hold a session token, they can read email, pull files from OneDrive and SharePoint, and set up mail forwarding rules to siphon future messages. Some tokens stay valid for weeks unless an administrator forcibly revokes them.

What should Microsoft 365 users and admins do?

For ordinary staff: if an email asks you to type a code into a Microsoft sign-in page, stop. Genuine collaboration invites from colleagues don't require that. Ring the sender on a known number and check.

For IT teams, Microsoft has published guidance on restricting the device code flow through Conditional Access policies. In most office environments, nobody has a legitimate need to use it, and blocking it outright removes the attack surface. You can read Microsoft's advisory on conditional access for the device code flow at https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-block-authentication-flows.

Admins who suspect exposure should review sign-in logs for device code authentications, revoke refresh tokens on affected accounts, and hunt for newly created inbox rules.

Should you worry about regulatory exposure?

Jurisdiction depends on who was hit. In the United States, business email compromise losses go to the FBI's IC3 and, where consumer data is involved, the FTC. UK organisations facing personal data exposure from an account takeover should check the ICO's own notification guidance for the applicable deadline and threshold, which varies by circumstance.