Crafty Microsoft Teams Booking Flow Disguises Device Code Phishing

A sophisticated phishing campaign targeting the construction industry uses a fake Microsoft Teams meeting scheduler to trick victims into authorizing device codes. The attackers employed a typosquatted domain and impersonated a senior executive to deliver spear-phishing emails with multi-stage redirects. The phishing site covertly initiates a Microsoft device-code sign-in and copies the code to the clipboard before redirecting victims to the legitimate Microsoft device-login page. The campaign includes fallback mechanisms for multi-factor authentication and uses residential proxies to evade detection.

• Inside Wazza: A Newly Observed Device Code Phishing Kit Targeting Microsoft 365 AccountsMalware2026-10-20
• Beyond the clipboard: The evolving tradecraft of ClickFixMalware2026-11-10
• Email threat landscape: Q3 2026 trends and insightsAnalysis2026-11-05
• The Internals of a Badbox OperationMalware2026-11-03
• Shutting the Door on the XCPE BotnetMalware2026-11-02