# DEBULL Tooling Fuels Wave of Device-Code Phishing Against Microsoft 365 Accounts


A sophisticated campaign targeting Microsoft 365 users has weaponized a legitimate authentication mechanism to bypass multi-factor authentication and seize control of corporate email accounts, according to new research from email security firm ZeroBEC. The attacks, which leverage reusable tooling infrastructure called DEBULL, represent an evolution of identity theft techniques that threaten organizations relying on traditional MFA protections.


The campaign, active between late June and early July 2026, demonstrates how threat actors are commodifying one of the most dangerous attack vectors in enterprise security: device-code phishing. Unlike conventional credential theft, this technique requires no fake login pages, no password interception, and no MFA compromise. Instead, it walks attackers directly through the front door using Microsoft's own authentication system.


## The Attack Mechanism: How Device-Code Phishing Works


Device-code authentication is a legitimate OAuth 2.0 flow designed for devices with limited user interfaces—think smart TVs, printers, or IoT equipment that cannot support traditional login screens. Microsoft's implementation operates in two stages:


1. A device generates a short alphanumeric code and displays it to the user

2. The user navigates to a separate device (typically a computer or smartphone) and enters that code into a browser

3. After entering the code, the user completes the standard Microsoft authentication flow, authorizing the session


This separation of concerns is intentional—it allows users to authenticate on a device without a web browser. However, threat actors have identified and weaponized a fundamental flaw: the code itself is decoupled from the authenticated entity requesting it.


The exploit path:

  • Attackers initiate a device-code authentication request, receiving a unique code from Microsoft's servers
  • They embed this code into a phishing lure (email, Teams message, or embedded document)
  • Victims click the link and are directed to Microsoft's *legitimate* login page
  • Upon completing authentication, the victim unknowingly authorizes the attacker's backend session
  • The attacker's polling server receives the authenticated token immediately

    • As Huntress researchers noted in their analysis of similar campaigns: "Device code phishing doesn't hack its way in. It uses a legitimate authentication flow to walk right through the front door, with no password required, MFA bypassed, and session tokens handed straight to the attacker."


    ## The DEBULL Campaign: Collaboration Lures and Storm-2372 Parallels


    The ZeroBEC research identifies strong overlaps between this campaign and Storm-2372, a Microsoft-documented threat actor group that conducted similar attacks in February 2025. Both campaigns share signature tactics:


  • Collaboration-themed lures: Phishing emails mimicking Microsoft Teams meeting invitations, document sharing notifications, or other team communication templates
  • Legitimate authentication flow abuse: Leveraging Microsoft's own device-code system rather than MITM credential pages
  • Reusable tooling: Attackers employ backend infrastructure that generates and polls device-code tokens, automating the attack chain

    • The distinction in this iteration is the formalization of these techniques into DEBULL—described as a "reusable tooling layer" that threat actors can deploy across campaigns. This tooling abstraction is significant: it suggests the attack pattern has been operationalized, debugged, and potentially commercialized for use across threat actor networks.


    ## Account Takeover Jumping: Cascading Compromises


    The campaign employs a secondary propagation technique called account takeover (ATO) jumping, which dramatically amplifies impact:


    1. Initial victims are compromised through device-code phishing

    2. Attackers abuse the compromised account to send phishing links to the victim's full contact list

    3. Links are embedded as buttons, hyperlinked text, QR codes, or attachments

    4. Each recipient who clicks initiates a new device-code phishing chain

    5. Successful compromises create additional compromised accounts to continue the chain


    This technique transforms a single phishing success into organizational-scale compromise. If a manager's account is hijacked, their direct reports—and their contacts—become targets. The attacker inherits the victim's organizational authority and trust relationships.


    ## Why MFA Doesn't Stop This Attack


    Organizations that believed MFA represented a complete solution to credential-based attacks face a critical wake-up call. Device-code phishing bypasses MFA entirely because:


  • No password is stolen: There is no credential to intercept or brute-force
  • MFA verification is legitimate: The user completes real multi-factor authentication on Microsoft's genuine servers
  • Authorization is intentional: From Microsoft's perspective, the user has legitimately completed authentication; the attacker merely provided the code

    • Traditional MFA defenses (hardware keys, TOTP, SMS verification) offer no protection because they verify the *user's* identity to Microsoft, not whether that user *should* approve access for the attacker's backend.


    ## The Commodification of Device-Code Attacks


    Research from Proofpoint published in May 2026 documented a troubling trend: device-code phishing is now available as a phishing-as-a-service (PhaaS) offering. Known PhaaS platforms include:


    | Service | Model | Status |

    |---------|-------|--------|

    | EvilTokens | Subscription-based device-code tooling | Active |

    | Tycoon | Turnkey phishing infrastructure | Active |

    | DEBULL | Reusable backend broker and polling service | Active |


    These services allow threat actors without deep technical expertise to conduct sophisticated MFA-bypass attacks. The barrier to entry has collapsed—operators can purchase access to proven tooling rather than develop it themselves.


    ## Immediate Consequences of Successful Compromise


    Once an attacker obtains a valid device-code token, they gain:


  • Full email access: Read, send, delete, and impersonate messages
  • Organizational intelligence: Access to corporate secrets, financial data, and strategic plans
  • Business email compromise (BEC): Authority to request wire transfers or sensitive actions
  • Lateral movement: Compromised accounts can target colleagues, contractors, and partners
  • Persistent access: Tokens grant long-lived sessions resistant to routine credential resets
  • Ransomware facilitation: Complete system access enables deployment of enterprise-scale threats

    • ## Defensive Recommendations for Organizations


    Immediate actions:


  • Review device-code authentication logs: Examine Azure Active Directory sign-in logs for device-code flows initiated outside your organization. Microsoft's Device Code Flow Authentication method appears as "Device Code Flow" in AAD logs.
  • Audit conditional access policies: Restrict device-code authentication to specific networks, geographies, or user roles. Block device-code flows from unexpected regions or non-corporate networks.
  • User training refresh: Educate employees that Microsoft will *never* ask them to enter a device code in response to an unsolicited message. Legitimate device-code flows originate from the device itself, not from phishing links.
  • Implement token-based anomaly detection: Use solutions that flag suspicious token usage patterns (unusual geographies, impossible travel, off-hours access).

    • Longer-term hardening:


  • Deploy passwordless authentication: Move beyond MFA toward Windows Hello for Business, FIDO2 security keys, or certificate-based authentication, which cannot be undermined by device-code phishing.
  • Enforce strict conditional access: Require additional verification for sensitive operations (email forwarding rule creation, admin access, mass recipient changes).
  • Monitor for ATO jumping patterns: Alert on rapid bulk email sends from compromised accounts or sudden increases in phishing link clicks from internal users.

    • ---


    ## HackWire Analysis


    The rise of device-code phishing represents a critical inflection point in enterprise identity security: attackers have weaponized a feature designed for *convenience* into a tool that defeats the most widely deployed defensive control—MFA.


    What makes DEBULL and its PhaaS peers particularly dangerous is their democratization of a sophisticated attack vector. Two years ago, device-code phishing required deep OAuth knowledge and engineering capability. Today, it's a $200/month service bundled with support and fresh payloads. This is the commodification pattern we've seen before: zero-day exploits become public; exploit kits emerge; PhaaS platforms distribute them at scale; defensive blindness spreads.


    The Storm-2372 precedent is also instructive. When Microsoft documented that group's device-code campaigns in February 2025, we saw a few quarters of relative quiet—security teams updated policies, vendors released detections. Now, in mid-2026, we're observing the *exact same tradecraft* resurface under a new branding (DEBULL). This tells us threat actors have not abandoned the technique; they've industrialized it.


    For organizations, the implications are stark: MFA alone is not sufficient defense against identity compromise. A user who completes legitimate authentication to their own account is indistinguishable from an attacker who has obtained a valid token. The security model must shift from "prevent unauthorized authentication" to "detect unauthorized *use* of authorized sessions."


    The most effective countermeasures are those that break the attacker's chain at early stages—user training to spot fake collaboration lures, conditional access policies that restrict device-code flows, and continuous monitoring for token misuse. Passwordless authentication (Windows Hello, FIDO2) offers the strongest long-term defense because it eliminates the OAuth flow entirely for most users, leaving device-code attacks with no entry point.


    Organizations relying on MFA as a "solved problem" should treat this campaign as a wake-up call: device-code phishing has entered operational mainstream, and the next wave will likely target your organization. — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Breaches](https://www.hackwire.news/category/breaches) coverage
  • Cross-reference with [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) and [Identity Threats](https://www.hackwire.news/category/threats)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)