Device-code phishing: “enter this code” on Microsoft’s real page

A “shared document” email asks you to copy a code and enter it at microsoft.com/devicelogin. The page is real — and typing the code signs the attacker into your account.

What it looks like

How it usually ends

There was no document. You signed in on Microsoft’s genuine page with your real password and MFA, and that approved the attacker’s session. No fake login page, no stolen password — so link checks and password managers see nothing wrong.

Red flags

• A message asks you to type a code into a sign-in page to “view”, “verify” or “join” something
• “Document shared” lures from SharePoint, OneDrive, Teams, Adobe or DocuSign that end in a code
• You didn’t start a sign-in on a TV, printer or other device yourself

A real case

Group-IB described the MadApe kit in October 2026: document-sharing lures that end with a code to type on Microsoft’s real device sign-in page, so the victim never enters a password on a fake site.

What to do

• Only enter a device code that is on a screen in front of you, for a sign-in you started.
• If a message gives you a code, stop and ask the sender through another channel.
• IT teams: block the device-code sign-in flow where it isn’t needed.

Could you spot it in the moment?

In Painted Sky you’re born at random somewhere on Earth and live a whole life — and this scam is one of the fakes that can find you. Make the call yourself, then replay the same life with a lens that shows what was fake.

Related scams