Your practice manager gets a Teams meeting invite from a payer rep, or a shared “salary and benefits report.” The link shows a short code and asks her to enter it on Microsoft’s sign-in page. The page really is Microsoft’s, she signs in as usual, MFA and all, and nothing looks wrong. That’s device code phishing.
She has just signed an attacker into her Microsoft 365 account. It’s a sneakier twist on the phishing emails hitting healthcare harder than ever: no fake login page, and no password changes hands.
What’s actually happening in 2026
Device code phishing is a scam in which an attacker starts a Microsoft sign-in meant for devices like smart TVs and printers, then talks an employee into typing the resulting code on Microsoft’s real sign-in page. The employee completes the sign-in, including any MFA prompt, and the attacker receives tokens to that person’s email and cloud files.
Microsoft’s October 2026 Digital Defense Report says the once-niche technique is now “a preferred credential theft method for both nation-state and financially motivated actors.” In one campaign around February 2026, stolen tokens got into Microsoft 365 “bypassing passwords and MFA.”
In February 2025, Microsoft described a group it tracks as Storm-2372 sending fake Teams meeting invitations, then using the tokens to reach email and cloud storage “without needing a password.” Health was among its target sectors. Proofpoint saw widespread campaigns by September 2025, and a financially motivated group, TA2723, joined in October; one December 8 lure was a fake salary bonus and benefits report.
Why this is a HIPAA problem, not just an email problem
A practice mailbox holds referrals, lab results and billing questions. Microsoft watched Storm-2372 search compromised mailboxes for words like “password” and “credentials,” export what it found, and send new code lures to coworkers from the victim’s account.
HIPAA defines a security incident as attempted or successful unauthorized access to information in your systems (45 CFR 164.304), so an entered code counts before you know what was read. You must identify, respond to, mitigate and document it (45 CFR 164.308(a)(6)(ii)). If PHI was accessed, the Breach Notification Rule presumes a breach unless a documented four-factor risk assessment shows a low probability of compromise (45 CFR 164.402). Your sign-in and audit logs are the evidence either way.
What to actually do about it
Keep MFA, which Microsoft still calls essential; it just can’t stop a sign-in your own employee completes.
- Block device code flow with Conditional Access: Microsoft “recommends blocking device code flow wherever possible” and may already have added a managed blocking policy to your tenant; review its report-only results for legitimate uses like conference-room devices, then turn it on. Conditional Access requires Microsoft Entra ID P1, which Microsoft 365 Business Premium includes, so check your plan.
- Teach staff never to enter a code someone sent them: Proofpoint says lures usually call it a one-time passcode, and checking the address doesn’t help when the page really is Microsoft’s. If you didn’t start the sign-in, don’t finish it.
- Review sign-in logs for device code sign-ins: filter Entra sign-in logs by the “Device code” authentication protocol. Entra keeps them 30 days with P1 and seven on the free tier, so check now, then weekly.
- If a code was entered, revoke sessions and reset: the attacker holds tokens, not the password, so revoke the user’s sessions, as Microsoft advises, reset the password, and remove unfamiliar devices, MFA methods and forwarding rules.
- Document it as a security incident: HIPAA requires a record of the incident and its outcome, and what the logs show feeds your breach risk assessment.
Where ACS fits in
Our free 30-minute cybersecurity assessment checks whether device code flow is blocked, whether your plan includes Conditional Access, and who would revoke sessions if someone typed a code tomorrow. Conditional Access and audit logging are part of our managed cybersecurity. If nobody owns those settings, that’s what managed IT services for medical practices are for.
