Salary Review: A QR Code in a Word File That Ends at Microsoft's Device Code Sign-In

The Salary Review campaign hid a QR code inside a Word file that led law firm staff to Microsoft's real device code sign-in, where no password reaches the attacker.

Threat Watch has covered several device code phishing kits, including MadApe and Wazza. This campaign adds four things those posts did not have: a QR code inside a Word attachment instead of a link, a salary review lure, a sector focus on law firms, and Microsoft's own reporting on a single run.

How did a salary email turn a QR code into a Microsoft sign-in?

The email had no text, only a Word file

Microsoft's researchers observed messages with the subject Salary Review and no visible body text. The only content was a Word attachment, Your-Q3-Compensation-Summary.docx, made to look as if it came from the recipient's employer: company branding, the recipient's name, and a claim that pay had been revised after a Q2 performance review. A QR code in the document was offered as the way to see the details.

The QR code led to a fake OneDrive page with a real code

Scanning the code opened a page at splace[.]co[.]za that impersonated a OneDrive sign-in portal. Microsoft reports that the page had already made an authentication request to Microsoft's device authentication service before the recipient arrived. It showed the resulting code, told the recipient to copy it and continue, and ran a countdown timer that signalled each code had a limited validity window.

Microsoft's own page finished the flow

The recipient was then sent to the legitimate microsoft.com/devicelogin portal, entered the code and signed in. The flow behind that page is a standard: RFC 8628 lets a device without a browser show a code that the user enters on a second device, and it warns that an attacker can send a target the address and code by email. Microsoft says completing the sign-in would have transferred a valid session token to the attacker, granting persistent access to the Microsoft 365 account without exposing the password and without re-triggering MFA.

Who did the Salary Review campaign target?

Microsoft reports that the campaign targeted the professional services sector, specifically law firms and legal organizations, and that the organizations were almost exclusively located in the United States. Its chart of intended targets by industry puts professional services at 72.1 percent, technology and software at 22.5 percent and the rest at 5.4 percent, so this was a law firm campaign with a sizeable technology tail, not a legal-only one.

The messages went out between 13:27 UTC on 19 August and 2:59 UTC on 20 August 2026, a 13-hour period, to more than 10,000 users across more than 4,800 organizations. They came from smtp@wekash[.]net through Amazon Simple Email Service. A salary review is a message an employee expects to be private and personal, which is AegisAI's reading of why the lure arrived as a branded document rather than as a link.

Why did the attacker put the QR code in a Word file?

Microsoft's explanation is direct: the QR code moved the phishing URL out of the email body and into an image. A filter that reads links in text has nothing to read. AegisAI's addition: the code is also inside an attachment, so the image is one layer further from the message body, and the scan happens on a phone that may sit outside the mail controls altogether.

The quarter's numbers point the same way. Microsoft counted approximately 12.1 million QR code attacks in Q3, down 67 percent from Q2, with monthly volume 86 percent below its March peak. Within that smaller total, Word attachments accounted for 14 percent of QR code attacks in July and August and 20 percent in September. The same report notes that CAPTCHA-gated phishing began to recover while QR code attacks kept falling.

A second Q3 campaign used payroll lures for malware

Microsoft's report pairs Salary Review with a Spanish-language campaign on 21 September 2026 that reached more than 56,000 users across more than 8,100 organizations, led by Colombia (15 percent), the United States and Mexico (12 percent each). It was sent from carloxmextos[.]org, which passed SPF, DKIM and DMARC, and used purchase order and payroll lures. The payroll file, Nomina 21.09.2026.xml.001, was a RAR archive holding an Agent Tesla executable with a double extension. The two campaigns ran a month apart on separate infrastructure; the common thread is familiar business paperwork as the lure.

How can organisations protect Microsoft 365 from device code phishing?

Block the flow where there is no business need

Microsoft Learn recommends getting as close as possible to a unilateral block on device code flow. The steps: audit current use first, create a Conditional Access policy for all users with emergency access accounts excluded, target all resources, set the Authentication flows condition to Device code flow, grant Block access, and run it in report-only mode before switching it on.

Strengthen sign-in for the accounts that matter most

Microsoft's own recommendations for this campaign include passwordless sign-in and Conditional Access policies that require phishing-resistant MFA for privileged accounts, alongside awareness training and phishing simulations. Its report also publishes a hunting query that matches the sender address. That finds this run, but a new sender would pass it.

Why standard controls miss it

Link scanning has nothing to scan. The email body is empty and the URL lives in an image inside a Word file, so a control that extracts links from text sees a clean message with an attachment.

Password-focused defences have nothing to catch either. The only sign-in screen that matters is the real microsoft.com/devicelogin, so the address bar is correct, and the fake OneDrive page never asks for a password. What the attacker wants is a session token, and that request only becomes visible once someone has acted on the message.

How AegisAI stops this

Aegis does not classify infrastructure. It classifies intent. A lure with no attacker-owned infrastructure still has to ask the recipient to do something on the attacker's behalf, and that request is what gets classified, independent of how clean the destination URL is.

AegisAI's agents evaluate the message and the destination it points to together, and pull a malicious message out of mailboxes before users see or click it.

When a lure or a compromised session is caught, the response compounds: the message is withheld at classification, copies already delivered are retracted, rewritten links refuse a late visit, the account's outbound and internal mail gets rescanned, and lateral phishing attempts to colleagues are blocked at the same bar rather than treated as a fresh, unrelated message.

Book a demo How inbound protection works

How AegisAI stops credential phishing, 48 seconds

Recommendations for defenders

• Block Entra device code flow through Conditional Access for all users and resources: audit current use first, allow only documented cases, exclude emergency access accounts, and run the policy in report-only mode before enforcing it.
• Require phishing-resistant MFA for privileged accounts through Conditional Access, and move staff who handle client matters and payroll to passwordless sign-in.
• Decode QR codes in inbound images and attachments, including Word files, and judge the decoded address the same way as any link in the message.
• Review Entra sign-in logs for device code authentication and correlate each hit with a recent message that carried a QR code or an unexpected HR document.
• Search mail logs for the sender, subject and attachment name in the indicators below, and DNS and proxy logs for the phishing host.
• Add the pattern to awareness training and the reporting channel: an HR message that asks staff to scan a code and then enter a code on a Microsoft page is a report.

FAQ