You have multi-factor authentication. Here’s what it doesn’t stop

An attack that’s hitting Microsoft 365 right now doesn’t steal a password, doesn’t fake a login page, and doesn’t break multi-factor authentication. It asks one of your people to read out a short code – and they will, because it looks exactly like something they’ve done before.

Think about the last time you set up Netflix on a new television.

You didn’t type your password with the remote control. The TV showed you a short code, you went to Netflix’s website on your phone, typed the code in, and the television signed itself in. Simple, and completely legitimate.

Now imagine somebody else’s phone, not yours. If a stranger had the code from your screen, they could type it into the real Netflix site and end up signed in as you. Nothing has been hacked. The system did exactly what it was built to do.

Swap Netflix for Microsoft 365, and swap yourself for your finance director.

Why your training doesn’t cover this

Everything your staff have been told about phishing is about passwords and fake websites. Don’t click strange links. Check the address bar. Never enter your password on a site you don’t recognise.

None of that helps here, because none of it happens.

The attacker begins a sign-in of their own, and Microsoft issues them a code – that costs nothing and requires no access. They then message one of your people, often through Teams so it looks internal, saying something like IT here, quick check, go to this Microsoft page and enter this code.

Your employee does exactly what they’ve been trained to do. They check the link. It’s genuinely Microsoft’s. They go to the real page. They sign in properly. Their multi-factor prompt appears on their own phone, and they approve it, because they’re the one signing in.

Except the code wasn’t theirs. By entering it, they didn’t log themselves in — they finished the attacker’s login. The moment they’re done, somebody else is inside your business, signed in as your employee, with multi-factor authentication satisfied.

The person who did this was careful, suspicious, and followed the rules. That’s the part worth sitting with.

Why it’s worse than a stolen password

With a stolen password there’s an obvious response: change it, and the attacker is locked out.

That doesn’t work here. There was never a password involved. The attacker holds a valid session, and changing the password doesn’t end it. They stay signed in – reading email, downloading files, watching how your business communicates – until somebody realises and deliberately shuts that session down.

Most businesses have no process for that, because most businesses have never had to think past “we’ll reset the password.”

The fix is one setting, and you already own it

This is the frustrating and slightly reassuring part.

Almost no business has a legitimate reason for that sign-in method to be available at all. It exists for devices without keyboards — televisions, conference room equipment – and if your business doesn’t use it, it can simply be switched off. It’s a single policy inside the Microsoft 365 you already pay for. There’s nothing to buy.

There’s also a sensible way to do it that removes the risk of breaking anything. The setting can be turned on in a monitoring-only mode first, which shows exactly who in your business would have been affected without actually blocking anyone. If nobody legitimate is using it – and usually nobody is – you then enforce it properly. Nobody’s day gets interrupted.

So the honest position is that this is a well-understood attack with a free, low-risk fix that takes minutes. The only real question is whether anyone at your business has done it.

Three questions to ask

1. Is device code sign-in blocked in our tenant? Those words specifically. It’s a yes or no, and it takes about a minute to check.
2. If someone’s account were compromised right now, how would we end their session? Not reset their password — end the session. If that gets a vague answer, it’s worth fixing before you need it.
3. What does our staff security training actually tell people to look for? If the answer is “don’t give away your password and check the link”, it does not cover this, and your most careful people are the ones who’d fall for it.

Our founder demonstrates the attack and shows exactly how the setting is configured – worth sending to whoever looks after your Microsoft 365.

The free Business Risk Audit covers how your business would cope with an account compromise. Four minutes, no jargon.