Estimated reading time: 5 minutes
Attackers are getting past multi-factor authentication by having employees complete it for them, Ontinue’s first-half threat report shows. Device-code phishing and fake IT support calls on Microsoft Teams both work this way. For underwriters, a yes on the MFA question now says less.
The victim signs in on Microsoft’s real page. They pass multi-factor authentication (MFA). Then they hand the attacker their account.
That is device-code phishing, one of the techniques in Ontinue’s 1H 2026 Threat Intelligence Report. Ontinue, a Zurich-based managed detection and response firm, drew on its own customer environments, incident investigations and threat research.
Effective attacks “don’t rely on sophisticated exploits. They rely on trust,” said Balazs Greksza, Ontinue’s director of advanced threat operations.
MFA Phishing Through The Device-Code Door
Device-code sign-in exists for smart TVs, printers, and other devices without a proper keyboard. The device shows a short code. The user types it into a Microsoft page on another device and signs in.
Attackers send that code to the victim instead. The victim signs in and completes MFA on Microsoft’s genuine page. The access token goes to the attacker’s session.
Ontinue confirmed 10 such compromises at five customer organizations in May and June 2026. The victims included professional services, industrial manufacturing and financial services firms. Attackers registered their own devices on the victims’ networks to keep access. In one case, the same session reached three core Microsoft services within two minutes.
Some cases had no default Microsoft Sentinel alert when Ontinue found them. Microsoft’s own guidance calls device-code sign-in “a high-risk authentication method” and recommends blocking it “wherever possible.”
Fake IT Support On Microsoft Teams
The second technique needs no code at all. An outsider poses as the help desk on Microsoft Teams. Often the attacker first floods the target’s inbox with junk mail, then calls offering to fix it.
The caller talks the employee into opening Quick Assist, installing a remote support tool, or running a PowerShell command. The attacker needs no exploit. In one case Ontinue traced, a single Teams call led to a full malware implant.
Ontinue reviewed 393,433 external Teams contacts. About 1 in 990 showed at least one sign of someone posing as IT support. Around 30% of the organizations Ontinue monitors saw at least one.
Ontinue’s release says those organizations were “targeted.” Its report is more careful. It calls them “signs of impersonation, not confirmed attacks.”
The calls that worked were long, clustering around 20 minutes. Ontinue says training should prepare staff for a patient, friendly caller who sounds like a colleague.
Phishing-Resistant MFA And The Underwriting Question
Marsh McLennan lists MFA first among its 12 key cyber controls. It is already the control IT teams find hardest to run, Kaseya found.
MFA phishing has kept pace. Proofpoint tracked a China-aligned group whose kit relays the genuine Microsoft sign-in. The password and the MFA code both work. Travelers reported business email compromise claims 57% higher in the first half of 2026, driven largely by session token theft.
“MFA is definitely not the silver bullet that everyone says it is,” Travelers’ Matthew Butler said on the Cyber Insurance News podcast.
Get The Cyber Insurance News Upload Delivered
Subscribe to our weekly newsletter!
Passkeys are the usual fix. Microsoft began switching on passkey profiles automatically in Entra ID this spring, for tenants that had not set their own. Ontinue says the migration can leave the old weaknesses in place. If a company still accepts push, SMS, or one-time codes as a fallback, attackers will target those. “Enrolment numbers look good on a dashboard while the actual exposure barely moves,” Ontinue writes.
The help desk becomes the next target, Ontinue says. Attackers will try to talk support staff into issuing recovery credentials.
For underwriters, that sharpens the MFA question. Which sign-in methods does the company still accept? Does it block device-code sign-in? And who can reset a password with a phone call?
FAQ – MFA Phishing
What is device-code phishing?
An attack that abuses Microsoft’s sign-in for devices without keyboards. The victim enters an attacker’s code on Microsoft’s real page and completes MFA. The access token goes to the attacker.
Does MFA stop device-code phishing?
No. The victim completes MFA themselves. Microsoft recommends blocking device-code sign-in wherever possible.
How common is fake IT support on Microsoft Teams?
Ontinue found signs of IT-support impersonation in about 1 in 990 external Teams contacts. Around 30 percent of the organizations it monitors saw at least one. These are signs, not confirmed attacks.
How do fake IT support scams work?
The caller poses as the help desk, often after flooding the inbox with junk mail. They persuade the employee to open a remote access tool or run a command.
Do passkeys solve the problem?
They help. Ontinue warns that companies still accepting push, SMS or one-time codes as a fallback leave attackers a way in.
What should underwriters ask about MFA?
Which sign-in methods a company still accepts, whether it blocks device-code sign-in, and who can reset a password by phone.
Related Cyber Insurance Posts
- Healthcare Ransom Payments Keep Falling. Downtime Still Drives The Bill.
- Does the Cyber Insurance Industry Overrate MFA? (Opens in a new browser tab)
- MFA Security Gap: Why It Puts Cyber Insurance Coverage and Business Security at Risk(Opens in a new browser tab)
- Are Cyber Insurers and their Clients Putting Too Much Trust in MFA (Multifactor Authentication) to Stop Ransomware? (Opens in a new browser tab)
- Beazley Closes $140 Million Cyber CAT Bond; Good Sign for Cyber ILS Market(Opens in a new browser tab)