A sophisticated phishing campaign targeting the construction industry uses a fake Microsoft Teams meeting scheduler to trick victims into authorizing device codes. The attackers employed a typosquatted domain and impersonated a senior executive to deliver spear-phishing emails with multi-stage redirects. The phishing site covertly initiates a Microsoft device-code sign-in and copies the code to the clipboard before redirecting victims to the legitimate Microsoft device-login page. The campaign includes fallback mechanisms for multi-factor authentication and uses residential proxies to evade detection.