There’s a phishing campaign hitting Microsoft 365 accounts that doesn’t bother with fake login pages. It uses Microsoft’s own authentication flow against you.
ZeroBEC caught it running from late June into early July. The attackers send collaboration-themed emails — payment notifications, shared folder invites. Click the link and you land on a legitimate-but-compromised Croatian rental site that kicks off Microsoft’s device-code authentication. You enter the code they provide, and boom — they’ve got your session token. No password theft needed. MFA bypassed completely.
The campaign shares DNA with what Microsoft calls Storm-2372, a group they’ve been tracking since February 2025. But this time it’s wrapped in a reusable tooling layer called DEBULL. Think phishing-as-a-service, purpose-built for device-code attacks.
How device-code phishing works: Microsoft’s OAuth device authorization flow was designed for devices like smart TVs — limited input, can’t do a normal login. The user gets a short code, types it on another device, and authenticates. Attackers figured out they can initiate that flow themselves, send you the code via email, and when you enter it, you’re authorizing their session, not yours.
“Device code phishing doesn’t hack its way in,” Huntress notes. “It uses a legitimate authentication flow to walk right through the front door.”
ZeroBEC found DEBULL is likely a PhaaS platform running GraphSpy or something similar for post-exploitation. Operators can define page names, edit HTML/CSS/JS, and choose how to publish lures. The built-in templates include a Microsoft 365 device-code auth page, an OAuth callback page, and a modern landing page. Cisco Talos also spotted a related PhaaS panel called ARToken with over 80 API endpoints for device-code phishing and token persistence.
The fix isn’t technical — it’s awareness. Users need to know that legitimate-looking Microsoft auth prompts can be weaponized. Blocking device-code flows entirely isn’t practical, but monitoring for unusual device-code authentication requests helps.
