DEBULL Tooling Abuses Microsoft Device-Code Flow to Target M365 Accounts

A phishing campaign targeting Microsoft 365 accounts has been detected, using collaboration-themed lures to trick victims into giving up control of their accounts. The campaign was active from late June to early July. It exploited the Microsoft device-code flow to gain access to accounts. Notably, the campaign did not use a fake Microsoft password page, instead relying on a malicious lure to direct users to the legitimate Microsoft device login experience. This approach allowed attackers to bypass traditional phishing defenses. The campaign was identified by ZeroBEC.