The Real Login Page Was Part of the Scam - Microsoft

Right website. Wrong favor.

Checking the website address is a good habit. Keep it.

The catch here is that a real login page can complete a request you should never have approved. The page's identity and the reason you were sent there are two different questions.

A device code normally helps you sign in on another device. Think of entering a TV's code on your phone. You do the login on a trusted page, and the TV gets the access. The TV does not need you to type your password into it.

Now imagine the code came from somebody else's TV. Same real website. Very different favor.

What the document story hides

In the EvilTokens flow, the code is presented as a step toward opening a document. Completing the sign-in instead authorizes the attacker's session. That access can let an attacker use the account without learning its password.

Microsoft reported disrupting the service on September 22. Its investigation also described tools for examining compromised inboxes and tailoring later scams. That is reported activity, not proof that every affected account was used in every possible way.

The halo does not cover everything

Connor connects this reassuring detail to the halo effect: an overall positive impression can influence judgments about separate qualities.

Nisbett and Wilson's 1977 experiment used a warm or cold interview with the same instructor. Students' impressions influenced ratings of his appearance, mannerisms, and accent. They were not evaluating phishing messages.

The parallel is useful, but limited. A genuine Microsoft page can reassure you about Microsoft without establishing the intentions of whoever supplied the code.

Check whose access you are approving

Only enter a device code when it comes from an app or device you deliberately started signing in to. A surprise document email is not that situation.

If the request is unexpected, stop and ask the sender using an existing phone number or another trusted channel. Do not ask the suspicious message to vouch for itself.

Already completed a suspicious work-account sign-in? Tell IT promptly. They may need to revoke sessions and investigate other changes, not just reset a password.

Keep MFA enabled. This is a reason to check what you are approving, not a reason to throw away a useful protection.

What changed, and what remains uncertain?

Microsoft's disruption targets this service. It does not make device-code phishing disappear. Reported compromised inboxes are not a count of organizations fully taken over, and the research does not establish any one victim's motives.

This page is an article adaptation of Connor's September 23 video, not a verbatim transcript. Sources were checked September 26, 2026.