DEBULL Tooling and Compromised Website Used in Microsoft 365 Device-Code Phishing Campaign
Summary
A campaign observed in late June and early July 2026 used payment and shared-folder lures and a compromised Croatian rental website to broker Microsoft 365 device-code authentication. Researchers linked its tooling to DEBULL and related PhaaS kits.
Key points
- ZeroBEC observed the campaign from late June into early July 2026; it used payment and shared-folder phishing pretexts.
- The lures directed victims to a compromised Croatian rental website that reportedly orchestrated Microsoft device-code authentication.
- The campaign used Microsoft's legitimate device login flow rather than a fake password page, potentially letting attackers obtain session tokens when victims entered a supplied code.
- ZeroBEC assessed that the activity used Storm-2372-style tradecraft and likely involved reusable DEBULL tooling; it said GraphSpy or a derivative may handle post-authentication activity.
- Cisco Talos reported that ARToken exposes more than 80 API endpoints for device-code phishing, PRT persistence, email access, BEC operations and SharePoint exfiltration.
- The article also reports that EvilTokens and Tycoon 2FA support device-code phishing; it does not establish that the observed campaign resulted in confirmed account compromise.
Article Details
- Event Type
- Microsoft 365 device-code phishing campaign using collaboration-themed lures and a compromised website as an authentication orchestrator.
- Impact
- The campaign sought to take over victim accounts by inducing users to authorize attacker sessions through Microsoft's legitimate device-login flow. The article describes potential downstream access to email and files, business email compromise, and data exfiltration; it does not report a quantified number of victims or confirmed losses.
MITRE ATT&CK
T1114.002 · Remote Email CollectionThe described platforms support email access and operations, including exfiltrating email from compromised accounts.T1528 · Steal Application Access TokenThe device-code phishing flow was used to obtain authentication tokens after victims entered an attacker-provided code.T1550.001 · Application Access TokenThe article says operators used captured access tokens to access compromised Microsoft 365 accounts and maintain access.T1566.002 · Spearphishing LinkThe campaign used phishing emails with payment and shared-folder pretexts and links to initiate the attack.
People
Threat Actors
Vendors
Products
Microsoft 365 Apps for EnterpriseA Microsoft 365 device code phishing campaign observed in late June and early July 2026 used collaboration-themed lures and a compromised Croatian rental website to trick victims into authorizing attacker sessionsMicrosoft OneDrivefollowing successful device code authentication to maintain access, perform email operations, access OneDrive and SharePoint, and browse victim Microsoft 365 sessions outside the panel using a dedicated tool knownMicrosoft SharePointCisco Talos found ARToken, a PhaaS panel with APIs for PRT persistence, BEC, and SharePoint exfiltration.
Tools
ARTBrowserSharePoint, and browse victim Microsoft 365 sessions outside the panel using a dedicated tool known as ARTBrowser.ARTokenZeroBEC and Cisco Talos linked the activity to reusable tooling and PhaaS ecosystems including DEBULL, Storm-2372-style tradecraft, EvilTokens, ARToken, and Tycoon 2FA.DEBULLZeroBEC and Cisco Talos linked the activity to reusable tooling and PhaaS ecosystems including DEBULL, Storm-2372-style tradecraft, EvilTokens, ARToken, and Tycoon 2FA.EvilTokensZeroBEC and Cisco Talos linked the activity to reusable tooling and PhaaS ecosystems including DEBULL, Storm-2372-style tradecraft, EvilTokens, ARToken, and Tycoon 2FA.GraphSpyZeroBEC said the tooling likely involved DEBULL and GraphSpy-like post-exploitation workflows.Tycoon 2FAZeroBEC and Cisco Talos linked the activity to reusable tooling and PhaaS ecosystems including DEBULL, Storm-2372-style tradecraft, EvilTokens, ARToken, and Tycoon 2FA.