DEBULL Device-Code Phishing Campaign Targeting Microsoft 365
First seen Jul 8, 2026 · Updated Jul 8, 2026
A phishing campaign dubbed DEBULL abuses Microsoft's legitimate device-code authentication flow to hijack Microsoft 365 accounts, using collaboration-themed lures rather than fake login pages. Because the attack leverages the real Microsoft login experience and obtains valid OAuth tokens, it bypasses many traditional phishing detections and can persist beyond password resets. The campaign was active between late June and early July 2026, as reported by ZeroBEC.
Technical Analysis
The DEBULL campaign exploits the OAuth 2.0 device authorization grant flow, tricking victims into entering an attacker-generated device code on the legitimate microsoft.com/devicelogin page after receiving a collaboration-themed lure (e.g., fake meeting or document-sharing invite). Once authorized, the attacker receives valid access and refresh tokens tied to the victim's identity, granting persistent account access without needing credentials or triggering MFA prompts in the conventional sense, since the user unknowingly completes the legitimate auth challenge. This technique evades traditional anti-phishing controls that scan for spoofed login pages, as no fraudulent domain or credential-harvesting page is used. Organizations using Microsoft 365-integrated AI agents, Copilot extensions, or RAG pipelines that authenticate via delegated OAuth tokens are at risk of agent-level compromise, since stolen tokens could grant attackers the same scoped access an AI agent uses to read email, files, or calendar data, enabling data exfiltration or manipulation of agent-fed content.
Affected Systems
Microsoft 365 tenants using device-code authentication flow; Azure AD/Entra ID accounts; Microsoft Teams, Outlook, and SharePoint collaboration tools integrated with M365 identity; any third-party or AI agent applications using delegated OAuth tokens tied to compromised M365 accounts
Indicators of Compromise
- Collaboration-themed phishing lures referencing meeting invites/document shares
- Use of legitimate microsoft.com/devicelogin authentication flow
- Anomalous OAuth token issuance for device-code grant type outside normal user geolocation/device fingerprint
- (Specific hashes, domains, and sender addresses not disclosed in source reporting)
Remediation Steps
- 1
Restrict or Disable Device Code Flow
Where feasible, disable the OAuth device authorization grant flow in Azure AD/Entra ID Conditional Access policies unless explicitly required for specific use cases (e.g., headless devices).
- 2
Enable Conditional Access Policies
Enforce sign-in risk-based Conditional Access policies restricting device-code flow to trusted networks, managed devices, or specific user groups.
- 3
Monitor OAuth Token Issuance
Deploy monitoring for anomalous device-code authentication events, especially those originating from unfamiliar IPs, devices, or geographies, using Azure AD sign-in logs.
- 4
User Awareness Training
Educate users on the risks of entering device codes from unsolicited collaboration invites and to verify the legitimacy of such requests through secondary channels.
- 5
Revoke and Rotate Tokens
For suspected compromised accounts, revoke all active refresh tokens and sessions, and force password and MFA re-registration.
- 6
Audit Agent and Application OAuth Scopes
Review AI agent, Copilot, and third-party application integrations for delegated permissions scope creep, and limit token lifetimes and privileges for automated/agent-based access to M365 data.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.