Device code phishing: the Microsoft 365 scam that gets past SMBs’ MFA

Turned on multi-factor authentication (MFA) for your Microsoft 365 accounts? Great. It’s still one of the best protections out there. But a fast-growing phishing technique gets around it without ever stealing your password: device code phishing.

On September 22, 2026, Microsoft announced it had disrupted EvilTokens, a turnkey “phishing-as-a-service” platform built on this technique. Launched in February 2026, it was linked to more than 12,000 compromised inboxes at over 10,000 organizations. And Canada is among the countries where Microsoft saw the highest concentration of victims, along with the United States, the United Kingdom, Australia, India and France.

How the scam works

Microsoft offers a legitimate way to sign in from devices without a keyboard, like a smart TV, a printer or a Teams meeting-room device. The device shows a short code, and you type it into a Microsoft page from your computer or phone.

Scammers hijack this process:

1. They send you a believable email: an invoice, a request for proposal, a shared or to-be-signed document, a voicemail.
2. You’re asked to enter a code on a real Microsoft page to “open the document.”
3. You sign in as usual, with your password and MFA. Everything looks legitimate… because it is.
4. But that code belonged to the scammer. You’ve just authorized their device to access your account.

The result: the scammer gets into your email, OneDrive and SharePoint without knowing your password. According to Microsoft, that access can even survive a password reset if the sessions aren’t revoked.

Why SMBs are directly in the crosshairs

According to Microsoft’s technical report, EvilTokens victims included wholesale distribution, construction, financial services, real estate, higher education and healthcare organizations. Those are sectors full of Quebec SMBs.

The goal isn’t espionage. It’s money. Once inside a mailbox, EvilTokens used AI to find wire transfers, pending invoices and the people who approve payments, then to draft fake messages impersonating trusted contacts. Attackers also created inbox rules to hide their conversations. That’s the classic recipe for business email compromise (the supplier who suddenly “changes banks”). Microsoft was able to tie at least 13 FBI complaints to about US$1.7 million in reported losses, a figure it calls conservative, according to CyberScoop.

And the takedown doesn’t solve everything. A week earlier, Canadian security firm eSentire described another kit, GhostCode, which starts with… your website’s contact form. A fake purchasing manager writes to the sales team, then sends an “NDA to sign” through WeTransfer. The file leads to the same code prompt. In the case analyzed, attackers registered three devices in the victim’s account within 78 seconds, and one of them stayed in place even after the stolen access was revoked, Computerworld reports.

6 practical steps for your SMB

1. Block device code sign-in if you don’t need it. Microsoft recommends blocking it wherever possible, using a Conditional Access policy. Most SMBs have no use for it, except sometimes for Teams room devices, which can be excluded. Conditional Access requires Microsoft Entra ID P1, included in Microsoft 365 Business Premium. Not sure what you have? Ask your IT provider.
2. Give your team one simple rule. “We never enter a Microsoft sign-in code that someone sent us by email, text or Teams.” A real supplier doesn’t need that to share an invoice. Microsoft’s page even says you’re signing in “on another device”: that’s your red flag.
3. Be wary of requests that come through your contact form and quickly lead to a password-protected file or an “agreement to sign.”
4. Confirm any payment change through a second channel. Microsoft explicitly recommends it: if a supplier changes its banking details, call them at a number you already know, not the one in the email.
5. Watch for signs of intrusion: new inbox rules that move or delete messages, unknown devices in Microsoft Entra, newly added MFA methods, unusual sign-ins.
6. If someone entered a code, act fast. Temporarily disable the account, revoke sessions, remove unknown devices, check inbox rules and reset the password. Report the incident to the Canadian Centre for Cyber Security and, if fraud is involved, to the Canadian Anti-Fraud Centre. If personal information may have been accessed, Quebec’s Law 25 applies: document the incident and assess the risk of serious injury, as the Commission d’accès à l’information (in French) explains.

To help your team recognize malicious emails, the Canadian Centre for Cyber Security also offers a simple guide: Spotting malicious email messages.

At NeoTech Cloud Solutions, we set up and secure Microsoft 365 for Greater Montreal SMBs, remotely, in English and French. See our Microsoft 365 services and our cybersecurity services.

Book your free cyber check

Is device code sign-in open in your Microsoft 365? Are your access rules and MFA set up properly? In one short meeting, we’ll go through it with you, and you’ll walk away with a clear list of priorities. No jargon, no commitment.

👉 Book your free cyber check

Prefer to talk to us directly? Call 438-476-2322 or email info@neotechcloudsolutions.com.

Sources

• Microsoft On the Issues: Disrupting EvilTokens (September 22, 2026)
• Microsoft Threat Intelligence: Unmasking EvilTokens and device code phishing (September 22, 2026)
• CyberScoop: Microsoft and partners disrupt EvilTokens (September 22, 2026)
• SecurityWeek: EvilTokens disrupted by Microsoft (September 23, 2026)
• eSentire: GhostCode device code phishing kit (September 15, 2026)
• Computerworld: GhostCode attackers take over Microsoft 365 accounts (September 18, 2026)
• Microsoft Learn: Block authentication flows with Conditional Access
• Canadian Centre for Cyber Security: Spotting malicious email messages (ITSAP.00.100)