{"id":2137,"date":"2026-10-23T21:44:00","date_gmt":"2026-10-24T02:44:00","guid":{"rendered":"https:\/\/www.supportadistance.com\/device-code-phishing-microsoft-365\/"},"modified":"2026-10-23T21:49:39","modified_gmt":"2026-10-24T02:49:39","slug":"device-code-phishing-microsoft-365","status":"publish","type":"post","link":"https:\/\/www.supportadistance.com\/en\/device-code-phishing-microsoft-365\/","title":{"rendered":"The \u201cdevice code\u201d attack: phishing that goes through Microsoft\u2019s real sign-in page"},"content":{"rendered":"\n<style>\n.alt-article{--alt-teal:#279989;--alt-teal-dk:#1F7A6D;--alt-orange:#DA291C;--alt-ink:#13262D;--alt-muted:#4A5563;--alt-bg:#F6F5F1;--alt-line:#DAD6CC;font-family:Calibri,Carlito,\"Segoe UI\",Arial,sans-serif;color:var(--alt-ink);font-size:18px;line-height:1.6;max-width:820px;margin:0 auto;padding:0 16px}\n.alt-article *{box-sizing:border-box}\n.alt-article h2{font-size:clamp(23px,3.5vw,29px);line-height:1.25;margin:44px 0 14px;color:var(--alt-ink);padding-left:14px;border-left:5px solid var(--alt-teal)}\n.alt-article h3{font-size:21px;line-height:1.3;margin:24px 0 8px;color:var(--alt-ink)}\n.alt-article p{margin:0 0 14px}\n.alt-article a{color:var(--alt-teal-dk)}\n.alt-article .alt-eyebrow{text-transform:uppercase;letter-spacing:2px;font-size:14px;font-weight:700;color:var(--alt-orange);margin:0 0 8px}\n.alt-article .alt-lead{font-size:21px;color:var(--alt-muted)}\n.alt-article figure{margin:24px 0}\n.alt-article figure svg{width:100%;height:auto;display:block}\n.alt-article figcaption{font-size:15px;color:var(--alt-muted);margin-top:8px}\n.alt-article ul,.alt-article ol{padding-left:24px;margin:0 0 14px}\n.alt-article li{margin-bottom:6px}\n.alt-article .alt-callout{background:var(--alt-bg);border-left:5px solid var(--alt-orange);border-radius:8px;padding:18px 20px;margin:20px 0}\n.alt-article .alt-callout.teal{border-left-color:var(--alt-teal)}\n.alt-article .alt-callout p:last-child{margin:0}\n.alt-article .alt-rule{background:#0F1F26;color:#EEF1F4;border-radius:14px;padding:26px 28px;margin:24px 0;text-align:center}\n.alt-article .alt-rule p{margin:0}\n.alt-article .alt-rule .big{font-size:clamp(22px,3.5vw,28px);font-weight:700;color:var(--alt-teal);margin-bottom:8px}\n.alt-article .alt-steps{background:#fff;border:1px solid var(--alt-line);border-radius:14px;padding:22px 24px 10px;margin:14px 0 20px;box-shadow:0 2px 10px rgba(19,38,45,.05)}\n.alt-article .alt-steps ol{padding-left:22px}\n.alt-article pre{background:#0F1F26;color:#EEF1F4;border-radius:10px;padding:16px 18px;overflow-x:auto;font-size:15px;line-height:1.5;margin:10px 0 16px}\n.alt-article code{background:var(--alt-bg);padding:1px 6px;border-radius:4px;font-size:16px}\n.alt-article pre code{background:none;padding:0;color:inherit;font-size:15px}\n.alt-article .alt-cta{background:#0F1F26;color:#EEF1F4;border-radius:12px;padding:28px;margin:40px 0 24px;text-align:center}\n.alt-article .alt-cta p{margin:0 0 14px;font-size:20px}\n.alt-article .alt-btn{display:inline-block;background:var(--alt-orange);color:#fff;text-decoration:none;font-weight:700;padding:12px 26px;border-radius:999px}\n.alt-article .alt-sources{font-size:15px;color:var(--alt-muted);border-top:1px solid var(--alt-line);padding-top:16px}\n.alt-article .alt-sources ul{padding-left:20px}\n<\/style>\n<article class=\"alt-article\">\n<p class=\"alt-eyebrow\">Microsoft 365 \u00b7 Appelez le tech<\/p>\n<p class=\"alt-lead\">No fake website, no stolen password, and yet the hacker gets into your mailbox. Device code phishing uses Microsoft\u2019s real sign-in page to trick you into authorizing an intruder yourself. Here is how it works and how to block it.<\/p>\n\n<div class=\"alt-callout\"><p><strong>Why talk about it now?<\/strong> A campaign spotted in February 2026 hit more than 340 Microsoft 365 organizations, including in Canada, in construction, real estate, law, healthcare and financial services. Turnkey kits sold to fraudsters now automate the attack.<\/p><\/div>\n\n<h2>First, what is a \u201cdevice code\u201d?<\/h2>\n<p>It\u2019s a legitimate Microsoft feature. Some devices don\u2019t have a keyboard or a convenient browser: a meeting room TV, a console, a command-line tool. The device displays a short code and asks you to go to <code>microsoft.com\/devicelogin<\/code> on your phone or computer. You enter the code, sign in normally, and the device gets access to your account.<\/p>\n<p>The problem: nothing guarantees that the \u201cdevice\u201d waiting for that code is yours.<\/p>\n\n<h2>How the attack works<\/h2>\n<figure>\n<svg viewBox=\"0 0 760 430\" role=\"img\" aria-label=\"How a device code attack unfolds: the hacker generates a code and sends it to the victim, who authenticates on the real Microsoft page, and the hacker receives the access tokens\" font-family=\"Calibri, Carlito, Segoe UI, Arial, sans-serif\">\n<defs>\n<marker id=\"dc-a\" viewBox=\"0 0 10 10\" refX=\"9\" refY=\"5\" markerWidth=\"6\" markerHeight=\"6\" orient=\"auto-start-reverse\"><path d=\"M0 0L10 5L0 10z\" fill=\"#C7D0DA\"><\/path><\/marker>\n<marker id=\"dc-o\" viewBox=\"0 0 10 10\" refX=\"9\" refY=\"5\" markerWidth=\"6\" markerHeight=\"6\" orient=\"auto-start-reverse\"><path d=\"M0 0L10 5L0 10z\" fill=\"#DA291C\"><\/path><\/marker>\n<\/defs>\n<rect width=\"760\" height=\"430\" rx=\"14\" fill=\"#0F1F26\"><\/rect>\n<g font-size=\"15\" fill=\"#C7D0DA\">\n<rect x=\"24\" y=\"24\" width=\"200\" height=\"380\" rx=\"12\" fill=\"#2A1A17\" stroke=\"#DA291C\"><\/rect>\n<text x=\"124\" y=\"56\" text-anchor=\"middle\" font-size=\"18\" font-weight=\"700\" fill=\"#DA291C\">Hacker<\/text>\n<rect x=\"280\" y=\"24\" width=\"200\" height=\"380\" rx=\"12\" fill=\"#17303A\" stroke=\"#24434E\"><\/rect>\n<text x=\"380\" y=\"56\" text-anchor=\"middle\" font-size=\"18\" font-weight=\"700\" fill=\"#EEF1F4\">Victim<\/text>\n<rect x=\"536\" y=\"24\" width=\"200\" height=\"380\" rx=\"12\" fill=\"#17303A\" stroke=\"#279989\"><\/rect>\n<text x=\"636\" y=\"56\" text-anchor=\"middle\" font-size=\"18\" font-weight=\"700\" fill=\"#279989\">Real Microsoft<\/text>\n\n<text x=\"124\" y=\"96\" text-anchor=\"middle\" fill=\"#EEF1F4\">1. Requests a code<\/text>\n<path d=\"M200 102H560\" stroke=\"#DA291C\" stroke-width=\"2\" marker-end=\"url(#dc-o)\"><\/path>\n<text x=\"636\" y=\"128\" text-anchor=\"middle\" font-size=\"14\">Code valid<\/text><text x=\"636\" y=\"146\" text-anchor=\"middle\" font-size=\"14\">about 15 min<\/text>\n<path d=\"M560 152H232\" stroke=\"#C7D0DA\" stroke-width=\"2\" stroke-dasharray=\"5 4\" marker-end=\"url(#dc-a)\"><\/path>\n\n<text x=\"124\" y=\"196\" text-anchor=\"middle\" fill=\"#EEF1F4\">2. Sends a lure<\/text><text x=\"124\" y=\"214\" text-anchor=\"middle\" font-size=\"13\">\u201cTeams meeting\u201d,<\/text><text x=\"124\" y=\"230\" text-anchor=\"middle\" font-size=\"13\">DocuSign, voicemail<\/text>\n<path d=\"M216 210H300\" stroke=\"#DA291C\" stroke-width=\"2\" marker-end=\"url(#dc-o)\"><\/path>\n<text x=\"380\" y=\"204\" text-anchor=\"middle\" fill=\"#EEF1F4\">Receives the code<\/text><text x=\"380\" y=\"222\" text-anchor=\"middle\" font-size=\"13\">\u201center it to<\/text><text x=\"380\" y=\"238\" text-anchor=\"middle\" font-size=\"13\">access the document\u201d<\/text>\n\n<text x=\"380\" y=\"286\" text-anchor=\"middle\" fill=\"#EEF1F4\">3. Enters the code and<\/text><text x=\"380\" y=\"304\" text-anchor=\"middle\" fill=\"#EEF1F4\">signs in (MFA OK)<\/text>\n<path d=\"M460 294H560\" stroke=\"#C7D0DA\" stroke-width=\"2\" marker-end=\"url(#dc-a)\"><\/path>\n<text x=\"636\" y=\"290\" text-anchor=\"middle\" font-size=\"14\">Sign-in succeeds<\/text><text x=\"636\" y=\"308\" text-anchor=\"middle\" font-size=\"14\">on the real page<\/text>\n\n<path d=\"M560 358H232\" stroke=\"#DA291C\" stroke-width=\"2.5\" marker-end=\"url(#dc-o)\"><\/path>\n<text x=\"396\" y=\"348\" text-anchor=\"middle\" font-size=\"14\" fill=\"#DA291C\">4. Access tokens handed to the hacker\u2019s device<\/text>\n<text x=\"124\" y=\"352\" text-anchor=\"middle\" font-weight=\"700\" fill=\"#DA291C\">Email, files,<\/text><text x=\"124\" y=\"372\" text-anchor=\"middle\" font-weight=\"700\" fill=\"#DA291C\">Teams\u2026 no password needed<\/text>\n<\/g>\n<\/svg>\n<figcaption>The victim does everything \u201cright\u201d on Microsoft\u2019s real site; it\u2019s the device receiving the access that belongs to the hacker.<\/figcaption>\n<\/figure>\n<ol>\n<li>The hacker starts a \u201cdevice code\u201d sign-in themselves and gets a valid code, usually for about fifteen minutes.<\/li>\n<li>They send it to the target under a believable pretext: a Teams invitation, a DocuSign or SharePoint document to review, a voicemail, a call for tenders. Recent kits even display the code directly on a trap page generated on the fly.<\/li>\n<li>The victim goes to the <strong>real<\/strong> Microsoft page, enters the code, signs in and approves the MFA prompt.<\/li>\n<li>Microsoft hands the access tokens to the device that requested the code: the hacker\u2019s. They read the email, search for words like \u201cpassword\u201d or \u201cwire transfer,\u201d and send new lures to your colleagues from your account.<\/li>\n<\/ol>\n\n<div class=\"alt-callout\"><p><strong>The trap within the trap:<\/strong> MFA, even with a passkey, doesn\u2019t stop this attack, because the victim really does authenticate on Microsoft\u2019s site. And changing the password isn\u2019t enough: tokens already issued stay valid until they\u2019re revoked.<\/p><\/div>\n\n<h2>How to protect yourself<\/h2>\n<div class=\"alt-rule\"><p class=\"big\">Never enter a code you didn\u2019t ask for.<\/p><p>A legitimate device code only appears when <em>you<\/em> are setting up a device right in front of you: a meeting room TV, a console, a technical tool. Never in an email, a Teams message or a document.<\/p><\/div>\n\n<h3>For employees<\/h3>\n<ul>\n<li>Be wary of any <code>microsoft.com\/devicelogin<\/code> or \u201cEnter code\u201d page that arrives through a link.<\/li>\n<li>Read the confirmation screen: Microsoft shows the name of the app requesting access. If it isn\u2019t what you\u2019re setting up, stop.<\/li>\n<li>Entered a code by mistake? Call your IT support immediately, even late at night: every minute counts.<\/li>\n<\/ul>\n\n<h3>For the Microsoft 365 administrator<\/h3>\n<div class=\"alt-steps\"><ol>\n<li><strong>Block the device code flow with Conditional Access<\/strong> (Entra ID P1, included in Microsoft 365 Business Premium): Entra &gt; Protection &gt; Conditional Access &gt; New policy &gt; Conditions &gt; <em>Authentication flows<\/em> &gt; Device code flow &gt; Grant: <em>Block access<\/em>.<\/li>\n<li><strong>Start in \u201creport-only\u201d mode<\/strong> and review the sign-in logs filtered on the <em>Device code<\/em> protocol to find legitimate uses (Teams Rooms, admin tools). Only exclude what\u2019s documented, plus emergency access accounts.<\/li>\n<li>If device registration uses this flow, exclude the <em>Device Registration Service<\/em> from the policy.<\/li>\n<li>Limit who can register devices in Entra ID, and watch for unusual new registrations.<\/li>\n<li>Turn on sign-in risk policies and alerts on device code sign-ins.<\/li>\n<\/ol><\/div>\n\n<h3>If an account is compromised<\/h3>\n<p>Resetting the password isn\u2019t enough. You need to revoke all of the user\u2019s sessions, then check mailbox rules, registered devices and authorized apps:<\/p>\n<pre><code># Microsoft Graph PowerShell\nConnect-MgGraph -Scopes \"User.RevokeSessions.All\"\nRevoke-MgUserSignInSession -UserId \"user@yourdomain.com\"<\/code><\/pre>\n\n<div class=\"alt-callout teal\"><p><strong>No Entra ID P1 licence?<\/strong> Blocking through Conditional Access isn\u2019t available. Employee training then becomes your main defence. It\u2019s often a good reason to move to Microsoft 365 Business Premium.<\/p><\/div>\n\n<div class=\"alt-cta\"><p>Want to know whether the device code flow is blocked in your Microsoft 365?<\/p><a class=\"alt-btn\" href=\"tel:+18334441041\">Appelez le tech \u00b7 1 833 444-1041<\/a><\/div>\n\n<div class=\"alt-sources\"><p><strong>Sources<\/strong><\/p><ul>\n<li><a href=\"https:\/\/thehackernews.com\/2026\/03\/device-code-phishing-hits-340-microsoft.html\" target=\"_blank\" rel=\"noopener\">The Hacker News \u2013 device code phishing hits more than 340 organizations (March 2026)<\/a><\/li>\n<li><a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2025\/02\/13\/storm-2372-conducts-device-code-phishing-campaign\/\" target=\"_blank\" rel=\"noopener\">Microsoft Security \u2013 Storm-2372 campaign<\/a><\/li>\n<li><a href=\"https:\/\/learn.microsoft.com\/en-us\/entra\/identity\/conditional-access\/concept-authentication-flows\" target=\"_blank\" rel=\"noopener\">Microsoft Learn \u2013 authentication flows and Conditional Access<\/a><\/li>\n<\/ul><\/div>\n<\/article>\n","protected":false},"excerpt":{"rendered":"<p>Entering a code on Microsoft\u2019s real page is enough to hand your email to a hacker, even with MFA. How device code phishing works and how to block it in Microsoft 365.<\/p>\n","protected":false},"author":2,"featured_media":2150,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[55],"tags":[],"class_list":["post-2137","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog-and-news"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v28.7 (Yoast SEO v28.7) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Device code phishing: understand and block the attack<\/title>\n<meta name=\"description\" content=\"Device code phishing: a code entered on the real Microsoft page hands over your 365 account, even with MFA. How it works and how to block it.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.supportadistance.com\/en\/device-code-phishing-microsoft-365\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"The \u201cdevice code\u201d attack: phishing that goes through Microsoft\u2019s real sign-in page\" \/>\n<meta property=\"og:description\" content=\"Device code phishing: a code entered on the real Microsoft page hands over your 365 account, even with MFA. How it works and how to block it.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.supportadistance.com\/en\/device-code-phishing-microsoft-365\/\" \/>\n<meta property=\"og:site_name\" content=\"Online and on-site IT Support | 1-833-444-1041\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/Supportadistance\/\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-24T02:44:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-24T02:49:39+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.supportadistance.com\/wp-content\/uploads\/2026\/10\/device-code-phishing.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Fabrice Blanchet\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fabrice Blanchet\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.supportadistance.com\\\/en\\\/device-code-phishing-microsoft-365\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.supportadistance.com\\\/en\\\/device-code-phishing-microsoft-365\\\/\"},\"author\":{\"name\":\"Fabrice Blanchet\",\"@id\":\"https:\\\/\\\/www.supportadistance.com\\\/en\\\/#\\\/schema\\\/person\\\/36d1bceaa54d6f2cd235b9c853fb7c64\"},\"headline\":\"The \u201cdevice code\u201d attack: phishing that goes through Microsoft\u2019s real sign-in page\",\"datePublished\":\"2026-10-24T02:44:00+00:00\",\"dateModified\":\"2026-10-24T02:49:39+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.supportadistance.com\\\/en\\\/device-code-phishing-microsoft-365\\\/\"},\"wordCount\":726,\"publisher\":{\"@id\":\"https:\\\/\\\/www.supportadistance.com\\\/en\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.supportadistance.com\\\/en\\\/device-code-phishing-microsoft-365\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.supportadistance.com\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/device-code-phishing.png\",\"articleSection\":[\"Blog and news\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.supportadistance.com\\\/en\\\/device-code-phishing-microsoft-365\\\/\",\"url\":\"https:\\\/\\\/www.supportadistance.com\\\/en\\\/device-code-phishing-microsoft-365\\\/\",\"name\":\"Device code phishing: understand and block the attack\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.supportadistance.com\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.supportadistance.com\\\/en\\\/device-code-phishing-microsoft-365\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.supportadistance.com\\\/en\\\/device-code-phishing-microsoft-365\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.supportadistance.com\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/device-code-phishing.png\",\"datePublished\":\"2026-10-24T02:44:00+00:00\",\"dateModified\":\"2026-10-24T02:49:39+00:00\",\"description\":\"Device code phishing: a code entered on the real Microsoft page hands over your 365 account, even with MFA. How it works and how to block it.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.supportadistance.com\\\/en\\\/device-code-phishing-microsoft-365\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.supportadistance.com\\\/en\\\/device-code-phishing-microsoft-365\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.supportadistance.com\\\/en\\\/device-code-phishing-microsoft-365\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.supportadistance.com\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/device-code-phishing.png\",\"contentUrl\":\"https:\\\/\\\/www.supportadistance.com\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/device-code-phishing.png\",\"width\":1200,\"height\":630,\"caption\":\"Screen asking for a device code, with a fishing hook\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.supportadistance.com\\\/en\\\/device-code-phishing-microsoft-365\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.supportadistance.com\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"The \u201cdevice code\u201d attack: phishing that goes through Microsoft\u2019s real sign-in page\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.supportadistance.com\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/www.supportadistance.com\\\/en\\\/\",\"name\":\"Support informatique en ligne et sur place | 1-833-444-1041\",\"description\":\"#1 Computer Repair in Canada\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.supportadistance.com\\\/en\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.supportadistance.com\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.supportadistance.com\\\/en\\\/#organization\",\"name\":\"IROUTENETWORKS INC.\",\"url\":\"https:\\\/\\\/www.supportadistance.com\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.supportadistance.com\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.supportadistance.com\\\/wp-content\\\/uploads\\\/2016\\\/09\\\/IROUTENETWORKS-LOGO-2016-1.png\",\"contentUrl\":\"https:\\\/\\\/www.supportadistance.com\\\/wp-content\\\/uploads\\\/2016\\\/09\\\/IROUTENETWORKS-LOGO-2016-1.png\",\"width\":800,\"height\":80,\"caption\":\"IROUTENETWORKS INC.\"},\"image\":{\"@id\":\"https:\\\/\\\/www.supportadistance.com\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/Supportadistance\\\/\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/iroutenetworks-inc\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.supportadistance.com\\\/en\\\/#\\\/schema\\\/person\\\/36d1bceaa54d6f2cd235b9c853fb7c64\",\"name\":\"Fabrice Blanchet\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/6ad1349124dd95cc70e869189bf1758ed878ccd5c2ee57913d77c2028e889ccb?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/6ad1349124dd95cc70e869189bf1758ed878ccd5c2ee57913d77c2028e889ccb?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/6ad1349124dd95cc70e869189bf1758ed878ccd5c2ee57913d77c2028e889ccb?s=96&d=mm&r=g\",\"caption\":\"Fabrice Blanchet\"},\"sameAs\":[\"http:\\\/\\\/www.supportadistance.com\"]}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Device code phishing: understand and block the attack","description":"Device code phishing: a code entered on the real Microsoft page hands over your 365 account, even with MFA. How it works and how to block it.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.supportadistance.com\/en\/device-code-phishing-microsoft-365\/","og_locale":"en_US","og_type":"article","og_title":"The \u201cdevice code\u201d attack: phishing that goes through Microsoft\u2019s real sign-in page","og_description":"Device code phishing: a code entered on the real Microsoft page hands over your 365 account, even with MFA. How it works and how to block it.","og_url":"https:\/\/www.supportadistance.com\/en\/device-code-phishing-microsoft-365\/","og_site_name":"Online and on-site IT Support | 1-833-444-1041","article_publisher":"https:\/\/www.facebook.com\/Supportadistance\/","article_published_time":"2026-10-24T02:44:00+00:00","article_modified_time":"2026-10-24T02:49:39+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/www.supportadistance.com\/wp-content\/uploads\/2026\/10\/device-code-phishing.png","type":"image\/png"}],"author":"Fabrice Blanchet","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Fabrice Blanchet","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.supportadistance.com\/en\/device-code-phishing-microsoft-365\/#article","isPartOf":{"@id":"https:\/\/www.supportadistance.com\/en\/device-code-phishing-microsoft-365\/"},"author":{"name":"Fabrice Blanchet","@id":"https:\/\/www.supportadistance.com\/en\/#\/schema\/person\/36d1bceaa54d6f2cd235b9c853fb7c64"},"headline":"The \u201cdevice code\u201d attack: phishing that goes through Microsoft\u2019s real sign-in page","datePublished":"2026-10-24T02:44:00+00:00","dateModified":"2026-10-24T02:49:39+00:00","mainEntityOfPage":{"@id":"https:\/\/www.supportadistance.com\/en\/device-code-phishing-microsoft-365\/"},"wordCount":726,"publisher":{"@id":"https:\/\/www.supportadistance.com\/en\/#organization"},"image":{"@id":"https:\/\/www.supportadistance.com\/en\/device-code-phishing-microsoft-365\/#primaryimage"},"thumbnailUrl":"https:\/\/www.supportadistance.com\/wp-content\/uploads\/2026\/10\/device-code-phishing.png","articleSection":["Blog and news"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.supportadistance.com\/en\/device-code-phishing-microsoft-365\/","url":"https:\/\/www.supportadistance.com\/en\/device-code-phishing-microsoft-365\/","name":"Device code phishing: understand and block the attack","isPartOf":{"@id":"https:\/\/www.supportadistance.com\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.supportadistance.com\/en\/device-code-phishing-microsoft-365\/#primaryimage"},"image":{"@id":"https:\/\/www.supportadistance.com\/en\/device-code-phishing-microsoft-365\/#primaryimage"},"thumbnailUrl":"https:\/\/www.supportadistance.com\/wp-content\/uploads\/2026\/10\/device-code-phishing.png","datePublished":"2026-10-24T02:44:00+00:00","dateModified":"2026-10-24T02:49:39+00:00","description":"Device code phishing: a code entered on the real Microsoft page hands over your 365 account, even with MFA. How it works and how to block it.","breadcrumb":{"@id":"https:\/\/www.supportadistance.com\/en\/device-code-phishing-microsoft-365\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.supportadistance.com\/en\/device-code-phishing-microsoft-365\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.supportadistance.com\/en\/device-code-phishing-microsoft-365\/#primaryimage","url":"https:\/\/www.supportadistance.com\/wp-content\/uploads\/2026\/10\/device-code-phishing.png","contentUrl":"https:\/\/www.supportadistance.com\/wp-content\/uploads\/2026\/10\/device-code-phishing.png","width":1200,"height":630,"caption":"Screen asking for a device code, with a fishing hook"},{"@type":"BreadcrumbList","@id":"https:\/\/www.supportadistance.com\/en\/device-code-phishing-microsoft-365\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.supportadistance.com\/en\/"},{"@type":"ListItem","position":2,"name":"The \u201cdevice code\u201d attack: phishing that goes through Microsoft\u2019s real sign-in page"}]},{"@type":"WebSite","@id":"https:\/\/www.supportadistance.com\/en\/#website","url":"https:\/\/www.supportadistance.com\/en\/","name":"Support informatique en ligne et sur place | 1-833-444-1041","description":"#1 Computer Repair in Canada","publisher":{"@id":"https:\/\/www.supportadistance.com\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.supportadistance.com\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.supportadistance.com\/en\/#organization","name":"IROUTENETWORKS INC.","url":"https:\/\/www.supportadistance.com\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.supportadistance.com\/en\/#\/schema\/logo\/image\/","url":"https:\/\/www.supportadistance.com\/wp-content\/uploads\/2016\/09\/IROUTENETWORKS-LOGO-2016-1.png","contentUrl":"https:\/\/www.supportadistance.com\/wp-content\/uploads\/2016\/09\/IROUTENETWORKS-LOGO-2016-1.png","width":800,"height":80,"caption":"IROUTENETWORKS INC."},"image":{"@id":"https:\/\/www.supportadistance.com\/en\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/Supportadistance\/","https:\/\/www.linkedin.com\/company\/iroutenetworks-inc"]},{"@type":"Person","@id":"https:\/\/www.supportadistance.com\/en\/#\/schema\/person\/36d1bceaa54d6f2cd235b9c853fb7c64","name":"Fabrice Blanchet","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/6ad1349124dd95cc70e869189bf1758ed878ccd5c2ee57913d77c2028e889ccb?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/6ad1349124dd95cc70e869189bf1758ed878ccd5c2ee57913d77c2028e889ccb?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/6ad1349124dd95cc70e869189bf1758ed878ccd5c2ee57913d77c2028e889ccb?s=96&d=mm&r=g","caption":"Fabrice Blanchet"},"sameAs":["http:\/\/www.supportadistance.com"]}]}},"_links":{"self":[{"href":"https:\/\/www.supportadistance.com\/en\/wp-json\/wp\/v2\/posts\/2137","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.supportadistance.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.supportadistance.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.supportadistance.com\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.supportadistance.com\/en\/wp-json\/wp\/v2\/comments?post=2137"}],"version-history":[{"count":1,"href":"https:\/\/www.supportadistance.com\/en\/wp-json\/wp\/v2\/posts\/2137\/revisions"}],"predecessor-version":[{"id":2152,"href":"https:\/\/www.supportadistance.com\/en\/wp-json\/wp\/v2\/posts\/2137\/revisions\/2152"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.supportadistance.com\/en\/wp-json\/wp\/v2\/media\/2150"}],"wp:attachment":[{"href":"https:\/\/www.supportadistance.com\/en\/wp-json\/wp\/v2\/media?parent=2137"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.supportadistance.com\/en\/wp-json\/wp\/v2\/categories?post=2137"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.supportadistance.com\/en\/wp-json\/wp\/v2\/tags?post=2137"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}