Device-code phishing disguised as a Microsoft Teams meeting booking: Huntress traces an October intrusion from a spear-phish through a Microsoft Safe Links-wrapped Google share link to a scheduler page whose 'Booking Reference' is the device code, an in-browser decrypted kit that restarts the flow when MFA is required, and a token replayed through a residential proxy

In mid-October a Huntress SOC saw an employee of a construction company receive a spear-phishing email from a typosquatted domain impersonating another company's senior vice president; the link in the mail was wrapped by Microsoft Safe Links and pointed to a Google share link that redirected server-side to the lure page, so the mail body held the Google link and not the lure domain, which Huntress says sidestepped URL reputation checks for email security (Huntress, 2026-11-12). The page posed as a Microsoft Teams meeting scheduler, and behind it the backend started a Microsoft device-code sign-in; the "Booking Reference" shown to the victim is the device code, which the victim enters in a genuine Microsoft sign-in window (Huntress, 2026-11-12).

The kit is shipped as AES-256-GCM ciphertext that the browser decrypts, so that to an email scanner or crawler that does not run JavaScript the page is an encrypted blob; if Microsoft answers AADSTS50076 or interaction_required because MFA is required, the kit starts a new device-code session and restarts the flow (Huntress, 2026-11-12). After the victim finished, the attacker held a session token and the device-code login (Cmsi:Cmsi) was routed through a residential proxy; the compromised account had no MFA enrolled and was used from an unmanaged device, and Huntress contained the incident before it escalated (Huntress, 2026-11-12).

Triage: Huntress treats a device-code prompt that follows a link, a booking request or another unexpected interaction as suspicious, and the captured session shows up as a replay from another ASN and region within one session (Huntress, 2026-11-12).