The Phishing Page That Asked for a Code, Not a Password

A phishing campaign used a legitimate contractor's compromised Microsoft 365 mailbox to deliver OneDrive-styled landing pages that generated per-visit nine-character device codes, tricking recipients to complete real Microsoft device-code sign-ins (including MFA) and enabling account takeover; four mailboxes were quarantined and deleted. The report provides indicators (Cloudflare Workers host and lure URLs), maps to MITRE techniques, and recommends restricting device-code flows, user training on device-code red flags, and not trusting sender relationships as a safety signal.