The familiar advice to inspect a login page’s address remains useful. But it does not answer a second question: whose device are you authorizing?
The request can be the trap
In a May 21, 2026 warning about Kali365, the FBI described messages that send recipients to a legitimate Microsoft verification page with a device code supplied by an attacker. Entering that code can authorize the attacker’s session and expose account access tokens. The trick does not require a counterfeit password form. Source: FBI/IC3 advisory.
Microsoft’s September 22 analysis of EvilTokens describes related abuse of the legitimate device authorization flow, which is intended for devices that cannot conveniently support an ordinary interactive sign-in. The attacker initiates the request, then persuades someone else to complete it. Source: Microsoft Security.
A better question to ask
For a reader receiving an unexpected document or support message, the useful checkpoint is: did I start this device connection myself? A genuine login screen cannot tell you that an unexpected email’s story is genuine. Open the service independently and confirm the request through a known contact channel before approving an unfamiliar device.
For an organization, the FBI recommends examining legitimate device-code dependencies before restricting the flow. A blanket change without that inventory can disrupt real business processes. This is work for the account administrator, not a reason to abandon multifactor authentication.
If an unexpected authorization has already occurred, contact your organization’s security team promptly and preserve the message. Treat the incident as possible access authorization, not merely a leaked password.