Since August 2024, a threat group [Microsoft tracks as Storm, 2372](https://www.microsoft.com/en, us/security/blog/2025/02/13/storm, 2372, conducts, device, code, phishing, campaign/), assessed to be working toward Russian state interests, has been running a phishing campaign that does not look like phishing at all. It starts with a conversation, often on WhatsApp or Signal, with someone impersonating a trusted contact. Once rapport is built, the target receives what looks like an ordinary Microsoft Teams meeting invitation. Clicking it leads to a genuine Microsoft login page, asking the victim to enter a device verification code the attacker had already requested on their behalf. Enter that code, and the attacker receives a valid access token and full account access. No password is needed, and multi, factor authentication does not stop it, because the victim completes the sign, in themselves on the real page.

Microsoft's own reporting places the targets across government agencies, NGOs, IT services, telecoms, healthcare, higher education, and energy companies, spanning Europe, North America, Africa, and the Middle East. Once inside, the group has been observed using Microsoft Graph to search a compromised mailbox for words like "password" and "admin", and sending further phishing invites from the victim's own account to colleagues, turning one successful attempt into several.

A calendar invite carries a kind of trust an email doesn't. It arrives through a system built around a person's own schedule, meetings colleagues actually set up, reminders they created themselves, so it rarely gets the scrutiny a message from an unfamiliar sender would. Storm, 2372's technique, known as device code phishing, is built around that gap deliberately. The victim isn't asked to hand over a password. They're asked to complete a step that looks like a routine part of joining a meeting, entering a code, on a login page that is completely real. There is nothing visibly wrong to catch.

This is a meaningfully different animal from the earlier, more opportunistic wave of calendar spam that circulated around 2019, unwanted invites promising prizes or gift cards. What is happening now is a deliberate, patient, state, linked intrusion technique, and it has been active and evolving for well over a year.

Microsoft's security team announced expanded protections for Outlook and Teams calendars in late 2025, specifically aimed at cutting down on malicious meeting invites reaching end users. That is evidence this has moved from an edge case to a mainstream enterprise threat serious enough to warrant a platform, level response, not just a training slide.

The Middle East is explicitly named among the regions Microsoft has observed being targeted in this campaign, alongside Europe, North America, and Africa. Government and business hubs across the UAE and Saudi Arabia have also shifted heavily toward hybrid and remote work, so employees now handle a much higher volume of meeting invites from a much wider range of external contacts: clients, vendors, recruiters, and partners across time zones. The conditions for this specific technique to land are already in place in the region, not theoretical.

Would our environment currently allow a device code authentication flow to complete without triggering any alert?

Do we have policy or technical controls that restrict device code sign, in entirely, given it has no legitimate use case for most staff?

If an employee's mailbox were used to send phishing invites internally, how quickly would that be detected as anomalous sending behaviour?

Has anyone in a finance, IT admin, or executive assistant role been specifically briefed on this technique, given how much rapport, building precedes the actual invite?

Delivered as a Teams or calendar invite, usually after contact on a messaging app. It gets past defences because it uses a real Microsoft login page, with no malware or fake site involved. It defeats MFA entirely, because a valid token is issued to the attacker. Documented actor: Storm, 2372, Russian state, linked, active since August 2024.

Delivered as an email link or attachment, and increasingly caught by modern email security. Its impact on MFA depends on the attacker reusing the stolen credentials. Used across the broad criminal ecosystem.

Delivered as a phone call or voice message. It relies on the call itself, so there is no message to scan, and MFA is not typically relevant. Used across the broad criminal ecosystem. Read more in [How to Stop Employees from Falling for Vishing and Smishing](/resources/blog/vishing, and, smishing, how, to, stop, employees, from, falling, for, voice, sms, scams)

This is not a hypothetical or a dated case study. It is an active, named, state, linked campaign that has already reached organisations across this region, using a mechanism most security awareness programmes have never covered, because it doesn't involve a suspicious link or a fake login page at all, just a real one, requested at the wrong moment.

Calendar and meeting invites are exactly the kind of low, suspicion, high, trust channel SimuPhish's multi, vector simulations are built to test, covering the identity, level techniques actually being used against organisations in this region right now, not just the email and SMS scenarios most training still stops at.