How attackers turned a Teams meeting booking into a device code phishing trap

Attackers tricked an employee at a construction company into revealing a device code by using a fake Microsoft Teams meeting scheduler, allowing them to gain unauthorized access to the employee's account. The incident was identified by Huntress's security operations center before it could cause further damage. This type of attack exploits a legitimate Microsoft sign-in process, where an attacker initiates a sign-in and persuades the victim to enter a code on Microsoft's real login page, inadvertently granting access to the attacker.

The phishing attempt began with an email from a domain that closely resembled a legitimate senior vice president's address from another construction firm. The email contained a link that redirected through a Google share link to a lure page designed to look like a Microsoft Teams scheduler. The page featured the executive's headshot and offered a meeting about a potential long-term supply partnership. When the victim clicked 'Continue,' a Microsoft device code request was initiated on the attacker's backend, presenting the code as a 'Booking Reference' with a countdown timer to create urgency.

The phishing kit was cleverly disguised as AES-256-GCM ciphertext with the decryption key included on the same page, bypassing email scanners and crawlers that do not execute JavaScript. Once the victim entered the code on Microsoft's sign-in page, the attacker received the session token. If Microsoft required multi-factor authentication (MFA), the phishing page would inform the victim of a new code preparation and restart the device code session. The final login was routed through a residential proxy in New Orleans to mimic regular consumer traffic.

Huntress recommends treating unexpected device code prompts with suspicion and suggests restricting or monitoring device code authentication through conditional access if not needed. They also advise using phishing-resistant MFA and scrutinizing unfamiliar device sign-ins. Indicators of automated attacker infrastructure include programmatic user agents in interactive sign-in logs. After confirming a compromise, defenders should check for unauthorized MFA methods, unknown registered devices, unauthorized app consents, suspicious mailbox rules, and unusual outbound mail.