Cyber threats are evolving. Again.

Just when you think your systems are locked down, attackers change tactics – and this time, it’s more sophisticated than ever.

Microsoft has issued a warning about a new wave of cyber attacks targeting businesses like yours. It’s called device code phishing, and unlike traditional phishing attacks, this one doesn’t rely on stealing your password.

In fact, it doesn’t need your password at all.

Here’s how it works

It starts with what looks like a legitimate email. Maybe it’s an invite to a Teams meeting from someone in HR. You click the link, and you're taken to a genuine Microsoft login page – not a fake. Everything feels familiar. Nothing seems wrong.

Then, you're asked to enter a short device code included in the email – supposedly to finish logging in or join the meeting.

But here’s the catch: entering that code doesn't log you in. It logs them in – the attacker. On their device.

And because this happens through Microsoft’s official login flow, it can slip past your multi-factor authentication. The result? Full access to your Microsoft account – without you ever handing over a password.

What’s at stake?

Once inside, attackers can:

• Read sensitive emails
• Access private files
• Impersonate team members
• Launch internal phishing attacks
• And maintain access using session tokens, even if you change your password

It’s one of the most deceptive attack methods we’ve seen, because it doesn’t set off the usual red flags. No suspicious links. No fake websites. Just a genuine-looking login page – and a small code that opens the door.

So, how do you stay ahead of this?

At Orbital10, we focus on proactive, layered protection. Here’s what we recommend:

1. Educate your team

Your people are your first line of defence. Make sure they understand that device code logins are rare – and should always be treated with caution. If they receive a code unexpectedly, they should stop and verify it through a trusted channel (not email).

2. Disable device code authentication (if you don’t need it)

If your business doesn’t use device code login for legitimate workflows, disable it. Our team can help you review and harden your authentication policies.

3. Implement conditional access controls

Restrict login attempts to trusted devices, locations, and behaviours. By tightening the net, you reduce the risk of unauthorised access – even if someone falls for a scam.

4. Stay vigilant with real-time monitoring

Use advanced security tools that detect unusual logins, even when credentials aren’t compromised. And make sure you’re logging and reviewing authentications from unknown devices or IPs.

5. Keep security training ongoing

Cyber threats don’t stand still – and neither should your security awareness. Regular training and updates ensure your team stays alert to emerging tactics like this.

Your business deserves better security than “good enough”



At Orbital10, we don’t just react to threats – we help you anticipate them. If you’re concerned about how protected your Microsoft environment is, we can assess your current posture and build a resilient, future-proof strategy around it.

Let’s talk about strengthening your security. Contact us today to stay ahead of what’s next >