Most people have learned to look for a fake sign-in page: a misspelled web address, a logo that's slightly off. Attackers know that, so they're changing tactics. Recent security reports describe tricks where the victim signs in on a page that looks exactly right, sometimes because it is the real Microsoft page, or lets a "technician" connect to their computer using a real Microsoft tool.
Why it matters: once someone controls a work email account, they can read past conversations, learn who pays whom, and send fake invoices or "new bank details" messages from a real address. That's a common way invoice fraud starts.
Here are three tricks from the last few weeks of reporting, in plain English.
1. The "enter this code" trick
Microsoft has a legitimate sign-in method for devices without a keyboard, like a conference-room TV. The device shows a short code, and you type that code at microsoft.com/devicelogin on your phone or computer to sign it in.
Attackers abuse this. Security firm Group-IB describes a phishing kit it calls MadApe that works like this:
- An email arrives with a PDF that looks like a SharePoint "a file has been shared with you" notice, often about a payment, invoice or contract.
- The link leads to a page that shows a code and says to copy it to "open the document."
- It then sends you to the real Microsoft sign-in page, where you paste the code and sign in as usual, including your two-step approval.
Everything you typed went to Microsoft, and the attackers never see your password. But the code you entered belonged to them, so you've just signed their device in to your account. Group-IB first saw the kit in January and found it connected to more than 150 web domains, with lures in at least nine languages.
2. The fake shared document that runs the real sign-in somewhere else
Email security company ZeroBEC reported this month on a targeted attack it stopped and studied. The email had no text, just a PDF styled as a SharePoint sharing notice: the company's HR or accounting team had shared a benefits enrollment document, and the link would expire in three days.
Clicking through led, after a couple of "verify you're human" checks, to what looked like a normal Microsoft sign-in. It wasn't a copy of the page. It was the real Microsoft sign-in running in a web browser on the attacker's computer, mirrored to the victim's screen. Everything the victim typed, including the two-step code, went into the attacker's browser, and when sign-in finished, the attacker was the one signed in. To cover its tracks, the page then showed a genuine DocuSign "document not found" error, so the victim would think the link was just broken.
In ZeroBEC's test, the attacker's session went on to open messages in the mailbox and Microsoft 365's search, which can turn up files and conversations across the company. This is a close relative of the stolen "keycard" attacks we wrote about in They Never Needed Your Password.
3. The fake "IT support" Teams message
Microsoft's own security team described two break-ins at companies this fall that started with a Microsoft Teams message or call from someone posing as IT support or the help desk. The caller talked the employee into opening Quick Assist, the remote-help tool built into Windows, and reading back the connection code. That gave the attacker control of the computer, which they used to go after the company's network.
The messages came from outside the company, but with names chosen to look familiar, such as an account named after the company or a "Support" display name. Teams often labels these chats External, and sometimes Scam suspected. Those labels are worth paying attention to.
Three habits for your staff
- Never enter a code you didn't ask for. If a web page, email or document tells you to copy a code and paste it into a Microsoft page to "view a file," stop. Real shared files don't work that way.
- Open shared files from inside Microsoft 365, not from an email link or a PDF. If someone really shared a file, it will be in Teams, OneDrive or SharePoint under "Shared with me." A PDF whose only job is to send you to a link is a red flag.
- Check with a coworker before letting anyone connect to your computer. Real IT support won't mind if you hang up and call back on a number you already know. Treat any Teams message labeled "External" that claims to be IT as suspicious.
What good protection looks like
Good habits catch most of these, but settings catch the rest:
- Block the "enter this code" sign-in method for everyone who doesn't need it. Most small offices don't use it at all, and Microsoft 365 can turn it off.
- Sign-in policies that block risky logins, such as from unfamiliar locations, hosting services or devices the company doesn't manage.
- Alerts when something looks off, like a sign-in from a new country, a new email forwarding rule, or a new device added to an account, sent to someone who actually reads them.
- Limits on outside Teams contacts and remote-help tools, so a stranger can't message staff as "IT" or start a Quick Assist session unless you allow it.
Some of these settings require Microsoft 365 Business Premium or an add-on, so it's worth knowing which plan you have.
How we can help
We can review your Microsoft 365 sign-in protections and show you in plain English what's turned on and what isn't. We can also run a short staff refresher on spotting these scams, using real examples like the ones above. If someone on your team has already entered a code or let a stranger connect, call us right away. Contact us or call (480) 382-3289.
Sources: MadApe: The Code That Opens the Door (Group-IB), PhantomDOM: Microsoft 365 Browser-in-the-Middle Phishing (ZeroBEC), From help desk impersonation to AD CS abuse (Microsoft Security Blog), and The Hacker News weekly recaps of November 2 and November 9