Fake Microsoft account code page that relays the victim's one-time code to the operator's server

A phishing page styled as a Microsoft account sign-in step titled 'Enter your code', with six boxes for a six-digit code. The link in the lure e-mail carries the target's e-mail address, and the page shows it as the account being signed in. The page sends that address to its own server, which starts a real sign-in to the victim's Microsoft account, so the victim receives a genuine one-time code from Microsoft. When the victim types the code into the fake page, it is relayed to the operator's server, which completes the sign-in and keeps the account's session; the page then forwards the victim to the real Microsoft sign-in site. The whole page is one self-contained HTML file with no external scripts, on a domain registered shortly before the e-mails go out. Seen in November 2026 at msftportallogin[.]com, reached through a mailing service's click-tracking link.