Beware: attackers now using real Microsoft sign-in screen for phishing

A new wave of cyberattacks is utilizing authentic Microsoft sign-in screens to deceive users into providing sensitive credentials. According to reporting from Cybernews and Help Net Security, attackers are using Microsoft's own trusted login system to camouflage their phishing efforts, making the scams significantly harder to detect than traditional fake websites. These campaigns often incorporate specific themes to lure victims, with Infosecurity Magazine highlighting a particular campaign themed around Microsoft Teams. The objective of these attacks is to leverage the inherent trust users place in a genuine Microsoft interface to steal account information. Multiple industry outlets are tracking the evolution of these tactics.

The Check Point Blog notes that the trusted login system is being turned into a phishing weapon, while Infosecurity Magazine specifically identifies the abuse of legitimate login pages within Teams-themed attacks. Additionally, BusinessToday Malaysia has reported that businesses are being warned about scam tactics that utilize procurement-themed emails to target organizational members. This indicates a multi-pronged approach where attackers combine authentic login portals with professional-sounding lures to maximize their success rates against corporate targets. To understand the broader context of these threats, The Hacker News identifies device code phishing as the fastest-growing threat of 2026, citing six primary reasons for its rapid ascent. This trend aligns with a larger landscape of evolving toolsets, as CyberSecurityNews recently cataloged the top ten phishing kits used by hackers to launch cyberattacks between July 20 and July 26, 2026.

The shift toward using real sign-in screens represents a move away from easily detectable spoofed pages toward a method that exploits the actual infrastructure of the service provider to mislead the end user. Looking forward, the coverage suggests a continued focus on the proliferation of device code phishing and the deployment of advanced phishing kits. Organizations and individuals are advised to remain vigilant against procurement-themed emails and Teams-related lures that redirect to these authentic but weaponized login screens. Because these attacks utilize legitimate Microsoft pages, standard visual checks for fake URLs may no longer be sufficient. Future monitoring will likely center on how these specific phishing kits are updated to bypass emerging security defenses as the threat continues to grow through 2026.