FBI Warns Microsoft Users—New Attack Gains Access To Accounts

Oh, how delightfully predictable. Just when you thought your multi-factor authentication was keeping the bad guys at bay, the FBI popped up on May 21 to inform us that AI has learned a new parlour trick: device code phishing. This isn't your grandfather's Nigerian prince email; it's a sophisticated attack that swipes OAuth tokens like a pickpocket at a tech conference. Now your Microsoft 365 account, protected by all those layers of security, is as secure as a chocolate teapot. Absolutely marvellous.

The mechanics are almost beautiful in their perversity. Device code authentication, designed for devices that can't handle a full browser, is now a gaping wound in the corporate security armour. The AI-powered phishing campaign tricks users into entering a code that hands over the keys to the kingdom — OAuth tokens that bypass the precious MFA entirely. So all those enterprise training sessions about not clicking links in emails? Useless. The attacker doesn't even need your password. They just need you to be slightly helpful.

And this, of course, is what passes for progress in 2026. AI, which we were told would cure cancer and write poetry, is now streamlining the art of account takeover. The FBI's warning is a ritual incantation, a muttered acknowledgment that the game of cat-and-mouse has become a treadmill. Microsoft will patch, the attackers will pivot, and the rest of us will keep entering codes into strange web pages. The FBI warns, Microsoft scrambles, and we continue our ballet of panic and resignation. Cheers to the future.