How attackers turned a Teams meeting booking into a device code phishing trap

Attackers used a fake Microsoft Teams meeting scheduler to trick an employee at a construction company into approving a device code sign-in, obtaining a valid session token before Huntress’s security operations center identified the incident. Device code phishing abuses a real Microsoft sign-in flow: the victim enters the attacker’s code on Microsoft’s genuine device login page and completes multifactor authentication there.