Fake Teams scheduler used for device-code phishing at a construction firm
Original title: How attackers turned a Teams meeting booking into a device code phishing trap
The victim approved a real Microsoft device-code login; Huntress found the session after a valid token was issued.
Huntress reports attackers used a fake Microsoft Teams meeting scheduler to trick an employee at a construction company into completing a device-code sign-in. The email impersonated a senior vice president at another construction firm from a typosquatted domain and linked through a Google share to a lure that labeled the device code a booking reference. The kit decrypts with JavaScript so scanners see ciphertext, retries if MFA errors, and sent the login through a New Orleans residential proxy. The victim’s approval issued access tokens before the SOC identified the incident.
Unconfirmed: The construction company and the impersonated executive are not named.
- Clicking Continue started a device-code request on the attacker’s backend.
- Copy opened Microsoft’s genuine sign-in page with the code on the clipboard.
- After success the page sent the victim to a Calendly booking page.
- Huntress says python-requests or node in interactive sign-in logs can indicate automation.
- Post-compromise checks include rogue MFA, devices, app consents and mailbox rules.
Impact: Attacker obtained valid access tokens for the employee’s Microsoft account
- 1.Restrict or monitor device-code authentication with conditional access where the business does not need it.
- 2.Use phishing-resistant MFA and review unfamiliar device sign-ins.
- 3.After compromise, check rogue MFA methods, unknown devices, app consents, mailbox rules and outbound mail.
- ATT&CK
- T1566.002 Spearphishing LinkT1528 Steal Application Access TokenT1621 Multi-Factor Authentication Request Generation
- Vendors
- Microsoft
- Products
- Microsoft Teams
- Organizations
- Huntress
From the original article
2 min read at helpnetsecurity.com
Attackers used a fake Microsoft Teams meeting scheduler to trick an employee at a construction company into approving a device code sign-in. They got a valid session token before Huntress’s security operations center identified the incident. Device code phishing abuses a real Microsoft sign-in flow.
By Mirko Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.