Microsoft Teams meeting booking phishing trap compromises enterprise session

# Microsoft Teams meeting booking phishing trap compromises enterprise session

https://gcdradar.vercel.app/incidents/microsoft-teams-meeting-booking-phishing-trap-compromises-en · AIR-2026-1941 · live

- Lane: Breaches & attacks
- Severity: 3 (Confirmed exploitation): Confirmed exploitation with unauthorized session access obtained.
- Fix status: No fix needed
- First reported: 2026-11-13
- AI role: No AI role
- Products: Microsoft Teams

## Summary

Attackers used a fake Microsoft Teams meeting scheduler to trick an employee into approving a device code sign-in. The attackers obtained a valid session token before the incident was identified.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-11-13: How attackers turned a Teams meeting booking into a device code phishing trap (https://helpnetsecurity.com/2026/11/13/microsoft-teams-device-code-phishing)

## Sources

- 2026-11-13 Help Net Security: How attackers turned a Teams meeting booking into a device code phishing trap https://helpnetsecurity.com/2026/11/13/microsoft-teams-device-code-phishing

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.