It started with a message from someone our member knew well. It ended with a stranger reading their email.
In between, nothing looked wrong. There was no suspicious website and no strange attachment, just a meeting invite and a Microsoft sign-in page. We’re sharing what happened, with our member’s permission, because the trick behind it is clever enough to catch anyone. And because one setting stops it.
A familiar voice
The first message came from a foreign number. The sender said they were someone our member knew and respected, and they were convincing. They wrote the way that person writes, switching between languages just as they always do.
They weren’t in a hurry. They just wanted to catch up soon.
That’s what makes this kind of approach work. By the time the first message landed, someone had already done their homework: who our member trusts, and how that person sounds.
A real website, a real sign-in
A meeting link followed. To join, our member needed to enter a short code, and quickly, because it would soon expire. The link went to microsoft.com/devicelogin, a genuine Microsoft page. It exists for devices without a proper keyboard, like a smart TV or a meeting room screen. The device shows a code, you type it in on your phone or laptop, and the device is signed in.
In this case, the “device” was someone else’s computer. They’d asked Microsoft for the code themselves and sent it over as the meeting code. Our member typed it in, signed in, and approved the request in Authenticator, the way they always do.
Nothing felt off, because Microsoft’s side of it worked exactly as intended. That’s why careful, experienced people fall for it. The warning signs we’ve all learned to look for simply aren’t there.
The call that made the difference
Our member called us 48 minutes later.
Within minutes, we were on a call with their organization’s IT partner. We removed the unknown device, ended every open session, and reset the password. The account had full admin rights, so we also checked whether anything new had been set up behind the scenes, like extra accounts.
Then we went through the logs. Emails had been read. Nothing had been sent, downloaded, or changed.
The next morning, our member had a list of every email that had been opened and the internet addresses used. They knew exactly what had been seen and who needed a heads-up. We also suggested they warn the real contact, whose account had most likely been taken over too, and report the case to the authorities.
Not your typical scam
Once things were safe, we looked at how it was done. It matched, almost step for step, a campaign Microsoft has been tracking since 2024 (read Microsoft’s full analysis). Someone poses as a well-known contact on a messaging app, builds a bit of rapport, then sends a meeting invite that leads to exactly this sign-in page. Microsoft links that campaign, with moderate confidence, to Russian state interests and to the group it calls Midnight Blizzard.
Even the internet addresses fit. They were local to our member’s own country, a way of blending in that Microsoft describes as well. We can’t say for sure who was behind this one. What we can say is that it took skill, patience, and research well beyond a typical scam. That’s why we recommended going to the authorities.
Three habits to close the door
This trick doesn’t rely on carelessness, so the answer isn’t more caution. One setting does most of the work. Two simple habits cover the rest.
01Ask your IT team to switch off device code sign-in
Most people never need it, and Microsoft itself recommends blocking it wherever possible. Do this for your work environment, and for any personal or family domain that runs on Microsoft 365.
02Pause when a meeting link asks for a code
A real meeting link opens a meeting. It does not ask you to type a code into a Microsoft sign-in page.
03Familiar is not the same as verified
The more a message matches exactly what you expect, the more it deserves a quick check. Call the person on the number you already have.
How Cyberwolf has your back
For our members, one call is enough. We work directly with your IT partner and stay with it until your account is yours again. We can also check whether device code sign-in is still switched on for your domains and help turn it off.
Nobody wants to second-guess every meeting invite. Switch off one setting, keep the habit of a quick call, and you can say yes to the next one with confidence.