- Published
- Source
- Cofense
- Filed under
- Phishing & scams
Cofense Phishing Defense Center (PDC) analysts uncovered a device code phishing campaign that impersonates trusted brands, including Microsoft, Syncfusion, and Mimecast, to trick users into granting attackers access to their accounts. Using fake bidding invitations and spoofed authentication pages, threat actors exploit legitimate device code authentication processes to potentially bypass traditional password and multifactor authentication protections.
Spotted a scam?
- Forward suspicious emails to report@phishing.gov.uk – the NCSC uses the reports to take scam sites down.
- Forward scam texts to 7726, free on most UK networks.
- Never share a one-time code, and check any request for money by calling a number you already trust.
Defender’s notebook
The attacker technique behind this story, in MITRE’s terms – and what to check in your own estate.
Impersonation
StealthWhat a defender checks
- Confirm any change of payment details on a number you already hold – never the one in the message.
- Make the help desk verify identity before resetting passwords or MFA.
- Brief finance and help-desk staff on the current pretexts.
Build the skillBlue Team Analyst · Email & Phishing Investigation
Phishing
Initial AccessWhat a defender checks
- Search mail flow for the sender, subject and links, and pull every copy from mailboxes.
- Check who clicked or replied, and what signed in afterwards.
- Block the sender and URLs, and tell staff what to look for.
Build the skillBlue Team Analyst · Email & Phishing Investigation
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
MyCyberWay training
Blue Team Analyst · Email & Phishing Investigation
Someone will report this email. Know exactly what to do next.
Analyse a reported phishing email properly: headers, message trace and quarantine, what SPF, DKIM and DMARC failures tell you, and the indicators that make it business email compromise.
- Header forensics and message trace
- SPF, DKIM and DMARC failures explained
- Spotting business email compromise
Headlines and short summaries only, except where a public body publishes under an open licence. Every story links to its publisher, who owns it. MyCyberWay does not edit or endorse third-party reporting.
