Numerous Microsoft users worldwide have reported receiving unexpected single-use verification codes. This security anomaly has escalated into a broader concern as the volume of complaints grows internationally.
The primary cause for concern is the authenticity of the correspondence. The received messages are not standard phishing attempts; they are legitimate security alerts generated directly by Microsoft’s official automated system. The system triggers these emails to facilitate passwordless logins by issuing a valid verification code. However, because the recipients did not initiate any sign-in attempts, the unsolicited generation of these codes indicates that unauthorized external parties are actively targeting these accounts.
Unexpected single-use verification codes were sent to numerous users around the world.
According to data compiled by the cybersecurity profile H4ckmanac on X (formerly Twitter), this widespread activity likely stems from automated, large-scale account enumeration attacks. In this scenario, threat actors leverage previously leaked credentials and databases to systematically test which email addresses are actively tied to valid Microsoft accounts.
‼️Multiple users are reporting suspicious Microsoft passwordless sign-in emails containing legitimate verification codes.
Threat actors are allegedly using leaked databases for large-scale account enumeration to identify email addresses linked to Microsoft accounts, potentially… pic.twitter.com/u7b9HnUAcr
— Hackmanac (@H4ckmanac) May 16, 2026
While receiving the email does not mean an account has been successfully breached, the validation process allows malicious actors to confirm active targets. This collected data can subsequently be utilized for automated login attempts or highly directed cyberattacks in the future.
Security experts advise users to maintain high vigilance regarding unexpected account activity. If an unsolicited verification code is received, the message should be entirely ignored. Furthermore, users are strongly encouraged to review their active account security settings. Recommended preventative measures include updating account passwords and enabling robust multi-factor authentication (MFA) protocols to establish supplementary layers of protection against automated intrusion methods. Although these defensive steps may not prevent hackers from triggering verification emails, they significantly reduce the likelihood of unauthorized account access.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。