How attackers turned a Teams meeting booking into a device code phishing trap

Attackers crafted a fake Microsoft Teams meeting invitation to lure an employee into completing a device code sign-in, a legitimate Microsoft authentication flow intended for input-constrained devices. By tricking the victim into entering an attacker-controlled code on Microsoft's real authentication page, the attacker obtained a valid OAuth session token without needing the user's password or MFA code directly. This attack is particularly dangerous because the victim interacts with a genuine Microsoft domain, making it nearly impossible to detect through URL inspection alone. The use of residential proxies further obscured attacker infrastructure, complicating detection and attribution efforts.