We handle all your technical problems so you can focus on growing your business.
A combination padlock and keys resting on a computer keyboard.
CybersecurityPractical insight for your business.

The Phishing Scam That Asks Your Employees to Type a Code, and How to Block It

Microsoft links a phishing service called EvilTokens to more than 12,000 compromised inboxes. It worked by getting people to type a short code into a real Microsoft page. Here is how the trick works, why MFA did not stop it, and the setting that blocks it.

Kevin R.

7 min read

Photo by Sasun Bughdaryan on Unsplash

The takeaway

Block device code sign-in unless you have a device that needs it, tell staff never to enter a code someone else sent them, and confirm payment changes by phone.

Most phishing tries to get you to type your password into a fake page. This one sends you to the real Microsoft page and asks for a short code.

On September 22, 2026, Microsoft published its analysis of EvilTokens, a phishing-as-a-service platform that it says emerged in February 2026. According to Microsoft, “within months of launching,” EvilTokens had been linked to “more than 12,000 compromised email inboxes across over 10,000 organizations worldwide” (Microsoft On the Issues). The sectors hit include construction, real estate, wholesale distribution, financial services, healthcare and higher education (Microsoft Security Blog).

Plenty of small businesses fall into those sectors, and the fix is a setting most of them can change.

How the scam works

Some devices can’t show a normal sign-in screen, such as a conference-room display or a smart TV. For those, Microsoft uses the “device code” sign-in. The device shows a short code, and you type it at microsoft.com/devicelogin on your phone or laptop to sign the device in.

EvilTokens turned that around. Based on Microsoft’s write-up, the attack runs like this:

  1. An employee gets an email that looks like a document to sign, a shared file, a bid request or a benefits notice. The kit offered 44 different themes.
  2. The link opens a page that asks Microsoft for a fresh device code and shows it with a “Copy Code” button.
  3. The page then sends the employee to the real microsoft.com/devicelogin page.
  4. The employee pastes the code and signs in as usual, including their MFA prompt.
  5. Microsoft then signs in the attacker’s session, not a conference-room screen.

Nothing in those steps looks unusual. The address bar shows Microsoft, and the sign-in is the one employees use every day.

Why MFA didn’t stop it

MFA is designed to stop someone who has only your password. Here, the employee completes the MFA prompt themselves and approves a sign-in that belongs to someone else. Microsoft says attackers use this flow “to circumvent traditional MFA protections by decoupling authentication from the originating session.”

Keep MFA on. Stronger sign-in methods are still worth having, but they are built to catch fake sign-in pages, and this attack doesn’t use one. The better defense is to block this type of sign-in completely.

Once inside, Microsoft says, attackers moved within minutes to hours, registering a new device to keep access or creating inbox rules to hide their activity. The platform also offered AI tools that could read a victim’s mailbox, find payment conversations and draft convincing messages to impersonate trusted contacts. That’s the setup for business email compromise: a fake “new bank details” email that comes from a real account in the middle of a real conversation.

The takedown

Microsoft’s Digital Crimes Unit says that, “with authorization from the U.S. District Court for the Eastern District of Virginia,” it “seized 50 websites used to operate the service and disabled more than 150 additional domains tied to its supporting infrastructure.” Microsoft also says London’s Metropolitan Police Service arrested two men, aged 32 and 38, on September 11, 2026, and that both were released on bail while the investigation continues (Microsoft On the Issues). A Met spokesperson confirmed the arrests to The Record. As of this writing, we couldn’t find a Met press release. The men were arrested on suspicion of offenses, and neither Microsoft nor The Record reports any charges.

Security researchers had been reporting on EvilTokens since March. The takedown disrupts one service, but the device code sign-in it abused still works in any tenant that hasn’t blocked it.

What to do

1. Block device code sign-in unless something needs it. Microsoft’s guidance is direct: “Microsoft recommends blocking device code flow wherever possible” (Microsoft Learn). How you do that depends on your plan:

  • Microsoft 365 Business Premium includes Microsoft Entra ID P1, which includes Conditional Access (Microsoft Learn). In the Microsoft Entra admin center, go to Entra ID > Conditional Access > Policies. First check whether Microsoft has already added a policy called Block device code flow (Microsoft Learn). If not, create one: under Conditions > Authentication flows, select Device code flow and choose Block access. Exclude your emergency admin account, start in Report-only to see what would break, then turn it on (step-by-step guide).
  • Business Basic and Business Standard include only the free tier of Entra ID, which doesn’t include Conditional Access. These plans use security defaults. Microsoft’s security defaults page lists “Blocking device code flow” among its protections (Microsoft Learn). But its dated note says only that “starting July 1, 2026, all new Microsoft Entra tenants block device code flow as part of security defaults,” so don’t assume an older tenant changed. Confirm that security defaults are on (Entra ID > Overview > Properties > Manage security defaults), and ask your IT provider to check whether device code sign-in is actually blocked in your tenant.

Watch for Teams Rooms devices. Some Teams meeting-room devices need device code sign-in. Microsoft has a separate guide for exempting only those room accounts while blocking everyone else.

2. Give staff one simple rule. Never type a sign-in code that came from an email, a text, a chat or a caller. A real device code appears on a device you are setting up yourself, in front of you. If a document or voicemail asks you to “copy this code and continue with Microsoft,” stop and ask IT.

3. Verify payment changes on a second channel. Microsoft’s Digital Crimes Unit advises organizations to “independently verify requests to change payment information, redirect funds, or approve unusual transactions through a trusted second channel.” In practice, call the vendor at a number you already have, not one in the email.

If someone already entered a code

Resetting the password is not enough, because the attacker is holding a sign-in session, not the password. Help Net Security reports that the stolen access persisted even after password changes. Microsoft’s EvilTokens guidance says “we recommend temporarily disabling the compromised account to ensure immediate containment,” even if that disrupts business briefly. In the Entra admin center, go to Entra ID > Users > All users, select the person, clear Account enabled, then select Revoke sessions (Microsoft Learn). Microsoft notes that apps can keep working until their current access token expires. By default, access tokens last one hour.

Then work through Microsoft’s compromised-account checklist. Remove any sign-in methods or devices the person doesn’t recognize, check for inbox rules and forwarding, and review what was sent from the account. If money or customer data may be involved, call your cyber insurer and ask counsel whether you have to notify anyone.

If you’d like help checking which of these settings your tenant already has, NightSquawk Tech offers a free assessment.

Sources

Editorial note: This article was drafted with AI assistance from the Microsoft sources and reporting linked above. Facts were checked against those sources, and the article was reviewed by Kevin R. before publication. NightSquawk Tech did not independently observe or test EvilTokens.