Fake Microsoft login pages: how to spot them and what to do

A fake Microsoft login page is the most common way business mailboxes get taken over. The email says your password is about to expire, a colleague shared a file, or a voicemail is waiting. The link leads to a sign-in box that looks exactly like Microsoft's. This guide shows how to tell it apart, what to do if you already typed your password, and which settings make a stolen password far less useful.

What does a fake Microsoft login phishing email look like?

The page is the trap. The email just gets you there. Microsoft Threat Intelligence's analysis of the Tycoon2FA phishing kit describes lures ranging from "generic notifications (like voicemail and shared document access)" to HR and finance themes. It says the fake page "mirrored the targeted service's branding and authentication flow, most often Microsoft or Gmail". At its peak, Microsoft linked the kit to "tens of millions of phishing messages reaching over 500,000 organizations each month worldwide."

Many arrive with an HTML or SVG attachment, a PDF with a QR code, or a link through a legitimate file-sharing or redirect service, so a simple link check doesn't catch them. Our guides to dangerous attachment types and QR code phishing cover those delivery tricks.

The password expiry lure is almost always fake

If your organization uses Microsoft 365 for business, check this. Microsoft Learn says: "By default, passwords never expire for your organization". It also says the Microsoft 365 admin center and Microsoft 365 apps "no longer support password expiration notifications." Your IT team may still set an expiry, but Microsoft won't email you a "keep my password" button.

How can you tell a fake Microsoft sign-in page from the real one?

Check the address bar, not the page

The page design proves nothing. Kits copy it, and Microsoft says a Tycoon2FA page "might even include company branding to enhance legitimacy." The address bar is what counts.

Microsoft's published list of Microsoft 365 URLs includes these login hosts:

• login.microsoftonline.com: the usual sign-in page for work and school accounts
• login.microsoft.com: listed in the same identity endpoint set
• login.live.com: listed for consumer Outlook.com and OneDrive, the sign-in page for personal Microsoft accounts

Read the domain right to left from the first single slash. login.microsoftonline.com.example-verify.net belongs to example-verify.net, not Microsoft. The same goes for a sign-in box on a forms site, a file-sharing site or a page opened from an HTML attachment on your own computer.

Other warning signs

• You arrived from an email. Microsoft and your IT team rarely need you to sign in from an email link. Open Outlook or office.com yourself instead.
• Your password manager doesn't offer to fill in. Password managers match on the site's domain, so silence on a "Microsoft" page is a strong hint.
• A CAPTCHA or "verify you're human" step comes first. Microsoft says Tycoon2FA's CAPTCHA pages were "designed to block automated scanners and ensure real users reach the phishing content."
• An MFA prompt or code request you didn't expect. If you didn't start a sign-in, deny it.

Why a correct domain isn't the whole answer

Two attack types use real Microsoft pages, so the domain check alone isn't enough:

• Device code phishing. The attacker sends you to the genuine microsoft.com/devicelogin page and asks you to enter a code. Microsoft's security defaults page warns that attackers abuse this flow "by tricking users into entering a code on another device." If an email or message asks you to enter a code there, stop.
• Consent phishing. A real Microsoft sign-in is followed by a request to grant an unknown app access to your mail and files. Our guide to OAuth consent phishing explains what to look for.

How do fake login pages get past MFA?

Basic fake pages just record your password. If you have MFA, that alone often isn't enough for the attacker. Modern kits go further.

CISA's fact sheet on phishing-resistant MFA describes the technique: an email convinces the user "to visit a threat actor-controlled website that mimics a company's legitimate login portal", and the user submits their username, password and "the 6-digit code from their mobile phone authenticator app."

Adversary-in-the-middle (AiTM) kits do this live. They pass what you type to the real Microsoft service, which sends you a genuine MFA prompt. When you complete it, Microsoft says "the attacker captured the session cookie and gained real-time access", and that Tycoon2FA could "bypass nearly all commonly deployed MFA methods." Read more in our guide to AiTM phishing and MFA bypass.

That's why the method matters. Microsoft Learn says MFA through SMS, email codes or authenticator apps is "prone to remote phishing attacks", and recommends Windows Hello for Business, passkeys and FIDO2 security keys, or certificate-based authentication. CISA puts it more bluntly: "The only widely available phishing-resistant authentication is FIDO/WebAuthn authentication." A passkey is tied to the real site, so it doesn't work on a lookalike.

What should you do if you entered your password on a fake page?

Act in the first few minutes. Your full recovery checklist is in what to do after clicking a phishing link; these are the Microsoft 365 specifics.

If you're the user

1. Close the page. Don't enter anything else.
2. Change your password from a trusted device. Type the address yourself. Microsoft Support says to "Immediately change the passwords on all affected accounts, and anywhere else that you might use the same password."
3. Tell IT now. Say whether you also typed an MFA code or approved a prompt. That tells them the session may be stolen, so a password change alone isn't enough.
4. Report the email. In Outlook, select the message and choose Report > Report phishing.

If you're the admin

1. Block sign-in and revoke sessions. In the Microsoft Entra admin center, go to Entra ID > Users > All users, select the user and choose Revoke sessions (Microsoft Learn). In PowerShell, Revoke-MgUserSignInSession does the same. Microsoft notes access tokens last one hour by default, so access may not end instantly.
2. Reset the password and require the user to re-register MFA if anything looks off.
3. Remove unknown MFA methods. Attackers often add their own phone or authenticator app.
4. Check inbox rules and forwarding. Rules that hide, delete or forward mail are a common next step. See malicious inbox rules and auto-forwarding.
5. Review sign-in logs and app consents for the hours since the click.
6. Search for the same message in other mailboxes and remove it. The Microsoft 365 message trace guide shows how to find who else received it.

Which admin settings protect against fake Microsoft login pages?

1. Turn on MFA for everyone

If you don't have Microsoft Entra ID P1 licenses, turn on security defaults. It costs nothing extra and requires all users to register for MFA, requires MFA for admins, blocks legacy authentication and blocks device code flow. Users approve sign-ins with number matching in Microsoft Authenticator, which Microsoft says helps prevent MFA fatigue attacks.

2. Require phishing-resistant MFA where it matters

With Entra ID P1, Conditional Access authentication strengths let you require a specific kind of MFA. There are three built-in strengths: Multifactor authentication strength, Passwordless MFA strength and Phishing-resistant MFA strength. The phishing-resistant strength allows only:

• Windows Hello for Business or platform credential
• FIDO2 security key
• Microsoft Entra certificate-based authentication (multifactor)

Start with admins, finance, HR and executives. Microsoft's Tycoon2FA report recommends "enforcing phishing-resistant MFA for privileged roles in Microsoft Entra ID."

3. Block what you don't use

Block device code flow unless a device really needs it, and restrict which apps users can consent to.

4. Keep the lures out of inboxes

Filtering cuts how many fake login emails reach users in the first place. In Microsoft 365, turn on the protections in our guide to stopping phishing in Microsoft 365. External sender tags, quarantine for suspected phishing, and blocking HTML attachments that don't need to arrive all help. An inbound gateway in front of Microsoft 365 adds another layer of link, attachment and impersonation checks.

5. Make reporting easy

Give users the Report button and thank them for using it. A quick report lets you pull the same message from every other mailbox. For other mail apps, Microsoft asks people to attach the original message to an email to phish@office365.microsoft.com and says "Don't forward the suspicious email", because it needs the original headers.

Fake Microsoft login checklist

Next steps

1. Tell staff that Microsoft 365 doesn't send "keep your password" emails, and that they should open Outlook or office.com themselves rather than sign in from a link.
2. Check that every account has MFA, then plan phishing-resistant methods for admins and finance.
3. Write down your response steps for a user who typed their password, including who revokes sessions.
4. Run the free Email Health Check on your domain. If you want filtering in front of Microsoft 365 before mail reaches users, see iBlockSpam for Microsoft 365.

Browse our other phishing and threat guides.