DEBULL Tooling Abuses Microsoft Device-Code Flow to Target M365 Accounts
Summary: A Microsoft 365 device code phishing campaign ran from the last week of June 2026 into early July, using collaboration-themed lures that pushed users into the legitimate Microsoft device login flow while a backend broker generated and polled Microsoft Authentication Broker device-code tokens, according to ZeroBEC. The activity shares strong overlaps with the Storm-2372 campaign Microsoft documented in February 2025, but ZeroBEC assesses the actors are applying that tradecraft through a reusable tooling layer called DEBULL, which it describes as likely a phishing-as-a-service platform using GraphSpy or a GraphSpy-derived workflow for Microsoft 365 and Entra post-exploitation.
Why it matters: Device code phishing needs no fake login page and no stolen password: the user completes a real Microsoft prompt, MFA is bypassed, and the session token goes to the attacker, which is why Proofpoint reported in May 2026 that these chains can be bought through PhaaS offerings like EvilTokens or Tycoon. ZeroBEC's finding that the lure can be changed without changing the backend identity stack means the same broker infrastructure can be re-skinned for the next campaign faster than most organizations revise their detection rules.
Read the original at The Hacker News ↗
- Topics
- Identity & Access Management
- Related
- FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026Sponsored: Specter Ops on the impact of AI agents on Blood Hound Cyber Risks · Sep 20, 2026