Researchers at ZeroBEC say a Microsoft 365 device code phishing campaign observed from the last week of June 2026 into early July used collaboration-themed lures to push victims into Microsoft's legitimate device login flow while a backend broker generated and polled Microsoft Authentication Broker device-code tokens. The activity was tied to a reusable tooling layer the company calls DEBULL.
The campaign shows how Storm-2372-style identity tradecraft — which abuses a legitimate OAuth flow to bypass MFA without stealing passwords — is now packaged into reusable, resellable phishing-as-a-service infrastructure, lowering the bar for account takeover, BEC and data theft against Microsoft 365 environments.
Key takeaways
- ZeroBEC observed a device code phishing campaign against Microsoft 365 accounts running from late June into early July 2026.
- The campaign used a legitimate Microsoft device-login flow rather than a fake password page, bypassing MFA and requiring no password theft.
- The tradecraft shows strong overlaps with Microsoft's February 2025 Storm-2372 campaign but is delivered through a reusable tooling layer called DEBULL.
- DEBULL is assessed to be a phishing-as-a-service platform using GraphSpy or a GraphSpy-derived workflow for M365 and Entra post-exploitation.
- Related PhaaS kits including ARToken, EvilTokens and Tycoon 2FA have adopted device code phishing, signaling a broader shift in the threat landscape.
Affected
What happened
Email security company ZeroBEC reported a Microsoft 365 device code phishing campaign observed between the last week of June 2026 and into early July, in findings shared with The Hacker News. Rather than presenting a fake Microsoft password page, the campaign used a collaboration-style lure to push users into the legitimate Microsoft device login experience.
According to ZeroBEC, a backend broker generated and polled Microsoft Authentication Broker device-code tokens. Victims were lured with payment and shared-folder pretexts to click a URL that led to a legitimate-but-compromised Croatian rental website, which acted as a device code orchestrator to initiate the Microsoft device code challenge chain.
The activity is assessed to share strong overlaps with Storm-2372, a campaign Microsoft documented in February 2025, but ZeroBEC assesses the operators are applying that tradecraft through a reusable tooling layer it calls DEBULL.
- Campaign observed from the last week of June 2026 into early July
- Used a legitimate Microsoft device login flow, not a fake password page
- Routed victims through a compromised Croatian rental website acting as orchestrator
How device code phishing works
Device code authentication is a legitimate OAuth 2.0 flow — the Device Authorization Grant — designed for devices with limited interfaces such as smart TVs or printers. A user is shown a short code and prompted to enter it into a browser on a separate device to complete sign-in.
Attackers abuse the separation between the two devices. The operator initiates the authentication flow, then shares the resulting device code with the target via a phishing lure. When the victim enters the code and their credentials into Microsoft's real login page, they unknowingly authorize the attacker's session, handing over session tokens.
No password needed, MFA bypassed
Because the technique uses a real, trusted authentication prompt, no password is stolen and MFA is effectively bypassed — session tokens are handed straight to the attacker.
ZeroBEC notes DEBULL exposes an operator layer where operators can define a page name and slug, edit HTML, CSS and JavaScript directly, and choose how the lure is published. Embedded templates included a Microsoft 365 device-code authentication page with a user-code display, copy-code behavior and a link to Microsoft device login, an OAuth callback page, and a modern landing page.
- Abuses the OAuth 2.0 Device Authorization Grant flow
- Turkish-language developer markers found, but not enough to attribute
Why it matters
ZeroBEC's key conclusion is that Storm-2372-style identity tradecraft is now being packaged into reusable broker infrastructure. DEBULL provides the campaign-facing and operator-facing layer, while GraphSpy or GraphSpy-derived code likely handles the post-authentication layer. The lure can be changed without changing the backend identity stack.
Successful device code phishing can facilitate full account takeover, theft of sensitive information, fraud, business email compromise (BEC), lateral movement within a compromised environment, and even disruptive attacks such as ransomware.
A broader PhaaS shift
The disclosure lands amid a wider adoption of device code phishing across phishing-as-a-service platforms. Proofpoint noted in May 2026 that codes are increasingly generated dynamically when a victim clicks the initial link, letting the email be opened at any time to start the chain, and that these implementations can be purchased via PhaaS offerings like EvilTokens or Tycoon or built by the operators themselves.
Cisco Talos said it identified a fully-featured PhaaS operator panel branded ARToken that shares infrastructure, API contracts and operational patterns with the EvilTokens platform. According to Talos, the ARToken panel exposes 80+ API endpoints for device code phishing, Primary Refresh Token (PRT) persistence, email access, BEC operations and SharePoint exfiltration, all accessible through a React-based dashboard.
Talos researcher Michael Kelley described ARToken as more mature than a simple device code phishing kit — a complete BEC operations environment. It includes a dedicated tool, ARTBrowser, to browse victim Microsoft 365 sessions outside the panel. eSentire separately noted in May 2026 that Tycoon 2FA operators repurposed their kit as a delivery framework for OAuth device code grant phishing following a law enforcement operation.
- ATO jumping: a compromised account is used to send phishing links to a broader set of contacts via buttons, hyperlinks, documents or QR codes.
- AI-powered features to sift thousands of harvested emails, identify finance-related threads and draft BEC messages at scale.
What defenders can do
Because the flow itself is legitimate, defenses focus on limiting where device code authentication is allowed and detecting anomalous token grants.
- Restrict or block device code flow via Entra ID Conditional Access where it is not needed.
- Monitor sign-in logs for device code authentication events, especially from unexpected users, locations or clients.
- Educate users that entering an attacker-supplied device code authorizes another party's session.
- Watch for post-compromise Microsoft Graph reconnaissance, mailbox rule changes and SharePoint/OneDrive exfiltration.
Timeline
Impact & actions
Attackers can achieve full Microsoft 365 account takeover using hijacked OAuth tokens, without stealing passwords and while bypassing MFA, enabling data theft, BEC and lateral movement.
Security: MFA is effectively bypassed because the victim completes a legitimate authentication and the attacker recovers the resulting token.
Privacy: Sensitive emails, files and other data in compromised Microsoft 365 accounts can be exfiltrated.
Recommended actions · High urgency
- 1Restrict device code authentication via Entra ID Conditional Access where it is not required.
- 2Train users not to enter device codes supplied through email or messaging lures.
- 3Monitor sign-in logs and Graph API activity for anomalous device-code grants and post-compromise behavior.
Technical details
- Exploitation
- Exploited in the wild
- Attack vector
- Phishing lure directing victims to complete Microsoft's legitimate OAuth 2.0 device authorization grant flow with an attacker-generated device code
Mitigations
- Block or restrict device code flow via Entra ID Conditional Access
- User awareness training on device-code lures
FAQ
What is device code phishing?
It is an identity theft technique that abuses the legitimate OAuth 2.0 device authorization grant flow. Attackers initiate authentication, share the device code with a victim through a phishing lure, and recover the resulting token when the victim completes sign-in — bypassing MFA without needing the password.
What is DEBULL?
DEBULL is a reusable tooling layer ZeroBEC associates with the observed campaign. It provides operator-facing and campaign-facing components — including editable Microsoft 365 device-code and OAuth callback templates — and is assessed to be a phishing-as-a-service platform using GraphSpy or a GraphSpy-derived workflow for post-exploitation.
How is this related to Storm-2372?
ZeroBEC assesses the campaign shares strong overlaps with Storm-2372, a device code phishing campaign Microsoft documented in February 2025, but delivered through the reusable DEBULL tooling rather than as a single actor's bespoke operation.
How can organizations defend against it?
Restrict or block device code authentication via Entra ID Conditional Access where it isn't needed, train users not to enter device codes received in emails or messages, and monitor sign-in logs and Microsoft Graph activity for anomalous token grants and post-compromise behavior.
The bottom line
ZeroBEC detailed a Microsoft 365 device code phishing campaign that abuses the legitimate device-login flow to hijack accounts, tied to reusable tooling called DEBULL with strong overlaps to Storm-2372.
What happens next
What to do
-640x640.webp&w=3840&q=75)
