DEBULL: device code phishing that walks past MFA

Here's a phishing technique that doesn't bother with a fake login page, doesn't need your password, and strolls straight past multi-factor authentication. It just asks you to type a short code into the real Microsoft sign-in page. Which you do, because everything looks legitimate. Because it is.

Researchers at ZeroBEC have been tracking a campaign running from late June into early July 2026 that abuses Microsoft's device code flow. That's the authentication mechanism designed for smart TVs, printers, and other devices that can't handle a normal login. The lure is a collaboration-themed email dressed up as a payment reminder or shared folder, pointing to a compromised Croatian rental site that quietly kicks off a device code challenge in the background.

The victim gets a code, enters it at the genuine Microsoft device login page, and hands the attacker a valid session token. No password stolen. MFA satisfied. Account owned.

DEBULL, and the kit economy around it

The tooling behind the campaign, dubbed DEBULL, shares heavy overlap with Storm-2372, the operation Microsoft flagged in February 2025. What's changed is the packaging. This tradecraft is now being sold as reusable phishing-as-a-service infrastructure, with editable HTML templates, an operator dashboard, and Turkish-language developer notes sprinkled through the code.

Post-compromise, operators appear to rely on GraphSpy or something built from it, which lets them pivot into email theft, SharePoint exfiltration, and full business email compromise once they've got a session token.

DEBULL is not alone in this space. Cisco Talos has been dissecting ARToken, a sibling of the EvilTokens platform, which exposes more than 80 API endpoints covering device code phishing, token persistence, and BEC operations, all fronted by a React dashboard. Tycoon 2FA, freshly rebounded after a law enforcement disruption, has also shifted toward device code grants.

The whole ecosystem is quietly migrating away from fake login pages and toward hijacking real ones.

Why the usual advice fails

Check the URL. Look for the padlock. Watch for typos. All good habits, and all useless here.

• The URL is microsoft.com/devicelogin. That's the actual Microsoft page.
• The padlock is real.
• The certificate is Microsoft's own.
• MFA prompts complete normally, because the victim is genuinely logging in. Just not for themselves.

The only real tell is behavioural. Nobody should be asking you to type a code you received in an email into a login page you didn't start yourself. If a message arrives with a code and instructions to enter it on a Microsoft sign-in screen, that's the moment to stop, not the moment to help.

That instinct is the thing worth building, because the attackers have worked out that the login page itself is no longer where the fight happens. It's happening one step earlier, in the assumption that anything hosted on a Microsoft domain must be safe to interact with.