By Huntress
Publication Date: 2026-11-12 14:00:00
Acknowledgments: Special thanks to Andrew Brandt for contributions to this investigation and writeup.
Background
Over the past year, Huntress has tracked several significant device code phishing campaigns, including the widespread Railway-based Microsoft 365 token replay campaign we reported in March.
In mid-October, the Huntress SOC observed an attack that was unique in the lengths it went to disguise this device code flow. Threat actors interlaced the components of the device code authorization process into what appeared to be a Microsoft Teams meeting-booking process.
The attack began with a spear-phishing email impersonating a senior vice president at a real company. A link in the email led the target through several redirects to the phishing site. Rather than immediately presenting the victim with a Microsoft sign-in page, as conventional credential-phishing pages often do, the site used a plausible “Microsoft Teams Meeting Scheduler” workflow to establish more context for…
