Canton Vaud warns of a device-code phishing campaign against Microsoft 365 accounts running in French-speaking Switzerland, with several organisations already affected
Vaud: device-code phishing against Microsoft 365 is running in Romandie; several organisations already affected
Defender actions
- In every Microsoft 365 tenant your organisation runs or administers, audit device code sign-ins with the authentication protocol filter of the sign-in logs and, where no documented device needs the flow, create a Conditional Access policy with the Authentication flows condition set to Device code flow and Block access, starting in report-only mode and excluding emergency-access accounts and, where devices register through it, the Device Registration Service.
Analysis
The canton of Vaud said on 2026-11-04 that a phishing campaign is currently running in French-speaking Switzerland and that several organisations have already been affected (translated from French) (Canton of Vaud, 2026-11-04). The messages can appear to come from a company or a known contact and invite the reader to view an invoice, open a document or verify information through a link; the campaign uses device-code phishing, which gets the victim to type a code on a genuine Microsoft authentication page and so gives the attackers fraudulent access to the Microsoft 365 account (Canton of Vaud, 2026-11-04). The links printed in the notice combine a company-style name and a portal word on a workers.dev subdomain whose second label starts with a cloud-storage word and an identifier, and the canton says other addresses can be used too (Canton of Vaud, 2026-11-04); workers.dev is the route assigned to every Cloudflare Worker (Cloudflare Docs, 2026-09-22). The notice names no actor, kit, count of organisations, sector or start date.
Triage: Microsoft documents device code sign-in for shared devices and signage; a device-code sign-in by a user who has no such device, soon after that user received a mailed link, falls outside that use (Microsoft Learn, 2026-03-24).
Cited evidence
A phishing campaign is currently running in French-speaking Switzerland. Several organisations have already been affected.
This campaign uses a technique called Device Code Phishing. It consists of getting you to enter a code on a legitimate Microsoft authentication page.
Sources4
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.