Most phishing advice comes down to one rule: check the address bar before you sign in. Device code phishing breaks that rule. The person types a code on the real Microsoft page, at microsoft.com, approves MFA as normal, and still hands their account to an attacker.
It isn’t rare. In September 2026 Microsoft said one device code phishing service, EvilTokens, was linked to more than 12,000 compromised inboxes across over 10,000 organizations before Microsoft’s Digital Crimes Unit took it down. Here’s how the scam works, what it looks like from the inside, and how to switch it off in Microsoft 365.
What is device code phishing?
Some devices can’t show a normal sign-in page: a meeting-room screen, a smart TV, a command-line tool. Microsoft lets them sign in with a device code. The device shows a short code, you open microsoft.com/devicelogin on your phone or laptop, type the code, sign in, and the device is now signed in as you.
Device code phishing turns that around:
- The attacker asks Microsoft for a device code. Microsoft hands it over, because anyone can start the flow.
- The attacker sends you that code with a believable reason: “Enter this code to open the shared document” or “Your Teams meeting needs verification.”
- You go to the real Microsoft page, type the code, enter your password and approve MFA.
- Microsoft signs in the “device” that asked for the code. That device is the attacker’s machine.
The attacker gets a valid token for your account. They never saw your password, and MFA was satisfied by you. It’s a form of token theft, with no fake login page to spot.
Why it has taken off
Device codes used to expire after 15 minutes, which made the scam awkward to run at scale. Microsoft’s April 2026 write-up of an AI-enabled campaign described attackers creating the code only at the moment the victim clicked the link, so it was always fresh. The same campaign used generative AI to write role-specific lures and picked out people in finance and executive roles.
In November 2026 Microsoft also described a campaign against legal organizations that used QR codes leading to a fake OneDrive page, which then issued a device code. Microsoft noted the resulting token gave lasting access without exposing the password and without asking for MFA again.
A worked example
This example is illustrative. Names and times are made up.
- Monday 10:02: Priya, the office manager at a 30-person accounting firm, gets an email that looks like a DocuSign-style notice from a client: “To view the engagement letter, verify at microsoft.com/devicelogin with code K7Q-MP2.”
- 10:03: She opens the link. It’s the genuine Microsoft page. She types the code, her password, and taps Approve on her phone.
- 10:04: The attacker’s script, which has been polling Microsoft, receives a token for Priya’s account.
- 10:20: From a server abroad, the attacker reads her mail, finds the firm’s billing thread with a large client, and adds an inbox rule to hide replies.
- Wednesday: The client receives an email from Priya’s real address with “updated” bank details.
Nothing about Monday morning looked wrong. Priya checked the address bar and it really was Microsoft.
Why the usual defences miss it
- “Check the URL” training doesn’t help, because the URL is genuine.
- MFA doesn’t help, because the person approves it.
- Password resets don’t fully help, because the attacker holds a token, not a password. Microsoft’s guidance is to revoke sessions and refresh tokens as well.
- Email filters may pass the message, because the only link points at Microsoft.
How to stop device code phishing: a checklist
Switch the flow off where you don’t need it
- Block device code flow with Conditional Access. Microsoft’s guidance is to get as close as possible to a full block, starting in report-only mode to see who still uses it. Microsoft describes device code flow as rarely used by customers but frequently used by attackers. See conditional access.
- Turn on Microsoft’s managed “Block device code flow” policy if it’s offered in the tenant, or rely on security defaults, which Microsoft says block device code flow for new tenants from 1 July 2026.
- Keep a short exception list for devices that genuinely need it, such as meeting-room systems, and review it.
Make stolen sign-ins harder to use
- Move admins and finance staff to phishing-resistant MFA.
- Limit sign-in to managed devices for the people who handle money.
Notice when it happens
- Watch the sign-in logs for device code sign-ins you don’t expect, especially from new locations or hosting networks.
- Alert on new inbox rules that forward or hide mail.
- Tell staff one simple rule: nobody at work will ever ask you to type a code from an email into microsoft.com/devicelogin.
Respond properly
- Revoke every session and refresh token, not only the password.
- Remove what the attacker added: inbox rules, MFA methods, app consents.
- Check who else received mail from the account while it was taken over.
How Centeye Gatewatch helps
Centeye Gatewatch watches every sign-in across Microsoft 365 and Google Workspace and spots stolen sessions replayed from someone else’s machine. When it finds one, it ends every session, resets the password and sign-in methods, and removes what the attacker added, such as forwarding rules.
For MSPs, that is one view across every client tenant, instead of reading sign-in logs one tenant at a time.
FAQ
What is device code phishing?
A scam that tricks someone into typing a device code on the real Microsoft sign-in page. That signs the attacker’s machine in as them, with MFA already satisfied.
Can device code phishing bypass MFA?
Yes. The person approves MFA themselves during the sign-in, so the attacker’s token is fully authenticated.
Should we block device code flow?
For most organizations, yes. Block it with Conditional Access and keep a short, reviewed exception list for devices that really need it.
Does changing the password stop it?
Not on its own. Revoke all sessions and refresh tokens as well, then remove anything the attacker added.
How is this different from AiTM phishing?
AiTM phishing uses a fake page that relays your sign-in. Device code phishing uses the real Microsoft page, which is why address-bar checks don’t catch it.
New to these terms? Our security glossary has plain-English definitions. Want to see stolen-session detection on your own Microsoft 365 or Google Workspace? Get started here.
Figures and campaign details from the Microsoft Security blog (6 April 2026, 22 September 2026 and 5 November 2026) and Microsoft On the Issues (22 September 2026). Device code flow guidance per Microsoft Learn. The worked example is illustrative.