Your marketing manager gets an invite to an “OpenAI Academy” livestream. Or a private “SpaceX AI for Marketing” briefing. Or something that looks like Anthropic at a big cloud conference. The prize is three months of a paid AI subscription, or even a “share” in a famous company. The catch is small and familiar: sign in with your work Microsoft or Google account to RSVP.
That is not a conference. It is a phishing campaign designed so that MFA looks like it worked, and the attacker still walks away with the session.
In early November 2026, a security vendor that watches browser traffic published a detailed breakdown of this campaign. Secondary coverage followed in the trade press. The pages looked like event registration. The delivery chain ran through short links and webinar-looking mail. The Microsoft button and the Google button each used a different phishing kit. Both kits exist to defeat or bypass the MFA most offices rely on.
If you run a medical practice, law firm, accounting office, or any small business where staff live in email and cloud apps, this is not a niche developer story. It is a board-level access story. Marketing, finance, and operations staff are often the first people leadership told to “get on the AI thing,” and they often hold the brand social accounts, the ad spend, and the shared inboxes.
Why “check the URL” training fails here
Classic phishing training tells people to look for the padlock, check the domain, and complete MFA. This campaign is built so those steps look fine.
On the Microsoft path, the victim sees a “Confirm access” dialog with a code, then a button that opens the real Microsoft device login page. The domain is genuine. MFA completes normally. What the victim actually did is authorize someone else’s device-code session. Tokens go to the attacker. In some variants, a second page then tries to capture a password and cookie as well.
On the Google path, the victim lands in a reverse-proxy sign-in that relays Google’s real login while capturing the password, the MFA response, and the session cookie. The user did everything “right.” The session still left.
That is the point. Advice written for fake lookalike domains does not stop a campaign that uses a real identity provider page, or a proxy that sits in front of one.
Who gets targeted, and why it works
The lure copy is aimed at marketing teams. That is rational from the attacker’s side. Marketing staff are under pressure to adopt AI tools, they often have access to public brand assets and paid media accounts, and they are rarely the audience for device-code awareness training.
The invitation links themselves often start on trusted services: short links, webinar senders, event pages that look familiar. Reputation filters see famous brands. The operator’s own domain only appears later, sometimes behind a “confirm you are not a robot” challenge that stops casual scanners.
None of that means Google, Microsoft, or a webinar vendor did something wrong. It means attackers ride trusted infrastructure until the last hop.
What actually reduces this risk
You do not need a new poster. You need a few controls most Microsoft 365 and Google Workspace tenants can turn on.
1. Restrict device code flow. In Microsoft Entra, Conditional Access can limit the device code authentication flow. Almost nobody in a ten-person office needs to sign a TV or a CLI tool into the company tenant with that flow. The people who do can sit in a named exception group with an owner. Everyone else should not be able to complete a device-code grant that hands tokens to an attacker-controlled session.
2. Move high-value accounts to phishing-resistant MFA. Passkeys and FIDO2 security keys are bound to the real site’s origin. A proxy on a different domain does not get a usable assertion the way a push notification or a one-time code does. Start with owners, admins, finance, and anyone who can change bank details or release payroll.
3. Hunt the leftovers in your logs. Look for device-code authentications by users who have never used one. Look for sessions whose IP or network changes right after a successful sign-in. That second pattern is what a stolen cookie often looks like from inside the tenant.
4. Say the rule out loud once. Real vendors do not give away paid AI subscriptions or stock for signing into a webinar with a work account. If the prize requires a work login, treat it as hostile until proven otherwise through a channel you already trust.
What to do if someone already clicked
Assume the session is burned. From a clean device, revoke active sessions for that user, reset the password, and review recent mailbox rules, OAuth app grants, and forwarding. Check whether the account changed MFA methods or registered a new device. If the person can reach billing, payroll, EHR, or practice management systems, treat those as in-scope for a short access review.
Do not reuse the same “change your password on the infected laptop” ritual. Change it from a known-good machine after the session is revoked.
How this fits a managed security program
Dark Edge Consulting helps small professional firms harden identity first: Conditional Access that matches how the office actually works, phishing-resistant MFA for the accounts that matter, continuous monitoring and alerting on odd sign-ins, and a short playbook for what to do when a lure gets through.
We do not promise that nobody will ever click. We do help you make a completed MFA prompt on a real login page stop being enough for an attacker to keep the account.
Adapted from a post by Andrew Trainum on Cybersecsloth.
—
Ready to review device-code access and MFA on your tenant? Book a strategy call.