Fake Teams Scheduler Steals Microsoft Sign-In Sessions

A phishing campaign disguised a Microsoft sign-in code as a Teams meeting “booking reference.” Entering that code on Microsoft’s real website could approve an attacker’s session, giving the criminal account access even after the victim completed multifactor authentication.

What happened

According to Help Net Security, an attacker emailed an employee at a construction company while impersonating a senior executive from another firm. The message promoted an introductory call about a possible supply partnership and linked through a Google sharing page to a fake Teams scheduler.

After the employee clicked “Continue,” the phishing site requested a real Microsoft device sign-in code. It presented that code as a booking reference and added a countdown timer to create urgency. Clicking the confirmation control copied the code and opened Microsoft’s genuine sign-in page.

The victim then entered the code and completed the normal Microsoft login process, including MFA when requested. However, the code belonged to the attacker’s sign-in attempt. Approval gave the attacker valid access tokens for the victim’s account.

The fake site later sent the victim to Calendly, making the meeting process appear legitimate. Help Net Security reported that the attacker routed the final login through a residential proxy in New Orleans so it resembled ordinary consumer traffic.

Who is affected

The reported victim worked for a construction company, but the technique can threaten anyone who uses a Microsoft account for email or work. Small offices are especially exposed when employees regularly receive meeting invitations, partnership requests or messages from unfamiliar vendors.

A real Microsoft address does not prove that a device-code request is safe. In this attack, the phishing page sent the victim to Microsoft’s legitimate login service after supplying a code controlled by the attacker.

What to do now

1. Stop if a meeting page gives you a “booking reference” to enter at Microsoft. Do not copy the code, click the confirmation button or complete the sign-in. Contact the supposed sender through a phone number or email address you already trust.

2. Treat unexpected device-code prompts as phishing. A meeting scheduler should not need you to approve a separate device sign-in. Close both the scheduling page and the Microsoft login window.

3. If you already entered the code, report the incident immediately. Ask the Microsoft 365 administrator to end active sessions and review unfamiliar device sign-ins. Help Net Security says the compromised company’s security team detected the attack only after a valid session token had already been issued.

4. Have the administrator inspect the account. The source recommends checking for unknown MFA methods, unfamiliar registered devices, unauthorized app permissions, suspicious mailbox rules and messages sent without the user’s knowledge.

5. Use phishing-resistant MFA where your Microsoft account supports it. CyberSec24 recommends a hardware security key for important personal and business accounts because it avoids approving sign-ins through copied codes.

6. Warn coworkers and family members about the trick. Emphasize that a genuine Microsoft login page can still be part of a scam when someone else supplied the code being entered.