Cybersecurity briefing
/
The Salary Review That Asked for Account Access
A salary-review lure sent staff to a real Microsoft sign-in page. Learn how email inspection and device code controls interrupt device code phishing.
/
AUTHOR
Jeff Dyer
/
SHARE THIS ARTICLE
Overview
The promise of a pay raise came in a personalized Word document, complete with company branding and a QR code. In research published November 5, Microsoft described an August campaign aimed at law firms and other legal organizations that used this invitation to steer employees toward device code phishing. The final step directed employees to a legitimate Microsoft page, where signing in could unwittingly authorize access for an attacker.
The message itself contained no visible text. Its attachment supplied the compensation story, and the QR code led to a counterfeit OneDrive page that instructed the recipient to enter a supplied code at Microsoft's real device sign-in portal.
For employers, the uncomfortable detail is the credibility of the last step. Advice to check the website address remains useful, but it cannot carry the entire burden when the authentication service is genuine and the request reaching it is fraudulent.
The code belongs to somebody else's session
Device authorization serves a legitimate purpose. A device with limited input capabilities can ask its user to finish signing in through a browser on another computer or phone. Under Microsoft's documented protocol, the requesting client receives a code, the user completes authentication elsewhere, and the client can obtain tokens that grant access within the authorized scope.
An attacker can occupy the requesting client's position. The employee supplies the authentication, while the attacker receives the resulting access. The password need never be entered into an attacker-controlled form. Multifactor authentication may also complete successfully because the employee is authenticating to the real service.
That changes the question employees need to ask. A valid address establishes where they are signing in. They must also understand which application or device they are authorizing and why a salary document requires that authorization. An unsolicited instruction to enter a device code deserves a pause, even when the next screen looks familiar.
Human resources can make that pause easier. Compensation notices should direct employees to a known internal portal they can reach independently. If the legitimate process routinely asks staff to scan unfamiliar codes and follow improvised sign-in instructions, security awareness has to compete with the behavior the employer has taught them.
Inspect the document before the conversation moves to a phone
A QR code creates another boundary for defenders. A link encoded as an image will escape inspection that only extracts ordinary text links. Scanning it with a personal phone can also move the next interaction away from the managed computer that received the message. The email remains an opportunity to interrupt the attack before that handoff.
Sublime Security builds email protection software for Microsoft 365 and Google Workspace, helping security teams identify phishing and investigate suspicious messages. Its platform examines message content, attachments and destinations, then gives analysts readable detection evidence and tools to find and quarantine related mail. It can operate alongside existing email defenses, which makes it relevant when an organization needs deeper inspection without immediately replacing its current system.
For this attack pattern, the useful mechanism is QR code and attachment analysis. The software uses computer vision to locate codes in supported content, decodes their destinations and follows redirects in a browser emulation environment. Office documents and nested attachments are part of the documented coverage. This exposes an encoded link to analysis instead of leaving it hidden inside the picture.
The surrounding evidence still matters. A legitimate final sign-in page cannot establish that the preceding request was authorized. Analysts need to examine the sender, the document's claim and the route into authentication together. Documented QR inspection is a credible control for this delivery method, not proof that a particular product would have stopped Microsoft's observed campaign.
Response also has to extend beyond the first reported copy. Sublime's Autonomous Security Analyst triages reported messages; its Autonomous Detection Engineer can create and test detection logic from confirmed misses. Teams can use that logic to hunt for related messages and apply configured remediation. Permissions, automation settings and the timing of inspection determine what a deployment can actually do.
Close the authorization route as well as the inbox route
Email cleanup cannot withdraw access already issued through an identity system. A report that an employee entered the code therefore needs an identity investigation alongside message removal. The response team should establish which application received access, examine subsequent activity and carry out the appropriate session and token containment. Treating the event solely as a malicious attachment risks ending the investigation too early.
The preventive control is unusually direct: restrict the authentication flow where the business does not need it. Microsoft recommends blocking device code flow wherever possible. Its guidance also recommends reviewing sign-in records or using Conditional Access in report-only mode to understand legitimate usage before enforcement. Shared devices and other necessary workflows need careful scoping rather than an untested blanket change.
Security leaders should put email and identity owners in the same review. Ask the email team to demonstrate inspection of a harmless QR code embedded in an Office document. Ask the identity team to show where device authorization remains permitted and which business process requires it. Give the help desk a clear escalation path when someone reports entering an unsolicited code, rather than merely receiving the email.
The salary lure depends on borrowing the employer's authority and then the identity provider's credibility. A stronger defense examines the request before the employee leaves the inbox, limits unnecessary authorization paths and responds promptly when access may already have been granted. The real Microsoft sign-in page should be one reassuring detail in a known business process, not the reason an unfamiliar request is trusted.
