Skip to content
NewA calmer, faster ZeroHour
StoryPhishing & fraudhigh

Fake Teams booking used in device-code phishing at construction firm

2 sources · 2 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

A mid-October spearphish used a fake Teams scheduler to obtain a Microsoft device-code approval at a construction company; Huntress says it contained the case.

Huntress says a mid-October email targeted a construction-company employee and impersonated a senior vice president at another firm via a typosquatted domain. Redirects through Microsoft Safe Links and a Google short link reached a fake Teams scheduler that started a device-code sign-in, copied the code, and opened Microsoft’s real device-login page. Help Net Security, citing Huntress, adds that the lure called the code a booking reference, decrypted its script in the browser so scanners saw ciphertext, retried MFA errors, and used a New Orleans residential proxy. Help Net Security says the victim’s approval issued tokens before the SOC identified the session; Huntress says the SOC contained the incident and notified the impersonated company. A successful flow then sent the victim to a Calendly page, according to Help Net Security.

Key facts
  • Mid-October spearphish targeted an employee at a construction company.
  • The lure impersonated another firm’s senior vice president on a typosquatted domain.
  • Redirects used Microsoft Safe Links and a Google short link.
  • Help Net Security says approval issued tokens before the SOC found the session.
  • Huntress says its SOC contained the incident and notified the impersonated company.
  • Huntress says python-requests or Node in interactive sign-in logs can indicate automation.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

What each outlet adds

beyond the shared facts
  • HuntressDescribes the mid-October lure, Safe Links path, containment, and domain notice.
  • Help Net SecurityAdds token timing, proxy, ciphertext kit, Calendly redirect, and log indicators.
Vendors
Microsoft
Products
Microsoft TeamsMicrosoft 365
Organizations
Huntress

Coverage

oldest first · one row per article · UTC
  1. · 1d ago HuntressFirst report

    Teams booking flow used to hide Microsoft device code phishing

    A mid-October spearphish against a construction firm copied a device code when the target confirmed a fake meeting.

  2. · 1d ago Help Net Security

    Fake Teams scheduler used for device-code phishing at a construction firm

    The victim approved a real Microsoft device-code login; Huntress found the session after a valid token was issued.