IdentityNov 2026
The Microsoft page was real. The mailbox still went to someone else.
November 5, 2026 · Steve Greenberg
A bookkeeper can type a short code on a real Microsoft page, pass MFA, and still hand the mailbox to someone else. This note teaches that trap in plain English. It is not a how-to.
Technology partners
The invoice looked ordinary
A bookkeeper gets “please sign the invoice.” After a CAPTCHA they land on a Microsoft sign-in page. They already use MFA (the extra check after a password), so it feels safe. The page asks them to type a short code.
Device code login, in one sentence: you type a short code on a real Microsoft page to approve a sign-in that started somewhere else. It exists so a TV or a conference room panel that cannot type a password can still sign in. Typing that code from an email is like unlocking the office for someone standing at a different door.
The Hacker News, on 5 November 2026, put this class of Microsoft 365 phishing first in its October roundup. In their words, one kit “exploits Microsoft’s legitimate device-code authentication to compromise corporate accounts without stealing passwords or bypassing MFA.” Kits they name (SkyW4lker, GeorgeGinx, Mir0Auth) stay in that citation. The staff rule does not depend on the name: never type a Microsoft code you did not start on a device in front of you.
What they lose next is mail, files, and the ability to send as them: a changed invoice, a quiet mailbox rule, not always ransomware. For VPN and backup lockups, see the Akira SonicWall chain and Anatomy of a ransomware attack.
What happened, in minutes
This is not a ransomware story that lasts weeks. A bookkeeper can lose the mailbox in one sitting. Six beats a defender can see. It is not a recipe.
The lure is ordinary office work: please sign, please pay, please open the file. The Hacker News, citing researchers, described kits that hide behind links that look trusted (Adobe shares, fake DocuSign pages) before anyone reaches Microsoft. You do not need the kit names to judge the email: unexpected, rushed, and asking you to finish a login you did not start.
It looks like Microsoft. That is not the question.
The padlock and the Microsoft name can both be real. The useful question is whether you started this login on the device in front of you.
What the bookkeeper reasonably believed
The test that actually holds
Microsoft recommends getting as close as possible to blocking device code flow. Read their Conditional Access article. We are not reprinting admin clicks here.
Questions people actually ask
You type a short code on a real Microsoft page to approve a sign-in that started somewhere else, often a session the attacker is already waiting on.
MFA still runs. You approve a real Microsoft sign-in. The extra check does not ask “did I start this on the device in front of me?” That is why a firm can have MFA on and still lose the mailbox.
No. This page teaches what a buyer can see: a real Microsoft page, a short code, MFA that still succeeds, and mail that moves. It does not include phishing kit steps, how to generate a device code, or OAuth grant recipes.
Names from The Hacker News’ 5 November 2026 roundup. They are kits researchers grouped around the same Microsoft device code login. The names do not change what staff should do: never type a Microsoft code you did not start.
Most offices should. Microsoft’s article on blocking authentication flows is the place to start. If you actually use TVs or kiosks that sign in this way, your IT partner should say so before the path is closed, not copy a click list from a blog.
Sources
Every external claim on this page points here. Open the primary document, not a recap.
- The Hacker News: 5 active cyber threats (5 Nov 2026)
Lead item: Microsoft 365 device code phishing (SkyW4lker, plus GeorgeGinx and Mir0Auth in the same roundup). Invoice and contract lures, a real Microsoft page, no stolen password. ANY.RUN counts they cite are theirs, dated to that article, not a Manage IT NY statistic.
- Microsoft Learn: Block authentication flows
Microsoft recommends getting as close as possible to blocking device code flow with Conditional Access. Read their article for the control. This page does not reprint the admin path.
- Microsoft Security Blog: Device code phishing (6 Apr 2026)
Same class of attack. Codes go stale quickly. Users should only complete a sign-in they started.
- Microsoft Learn: Responding to a compromised email account
Session revoke and mailbox cleanup if the account already moved. Follow Microsoft. This page is not an incident runbook.
Related reading: Email and phishing, Zero Trust access, and a free IT and cybersecurity assessment.