Actor Profile

DEBULL is a phishing campaign active from late June through early July 2026, targeting Microsoft 365 accounts through abuse of Microsoft's legitimate device-code flow authentication mechanism. Rather than relying on traditional credential harvesting via fake login pages, the campaign leverages authentic Microsoft login experiences combined with collaboration-themed social engineering lures. The campaign's motivation appears to be initial access to enterprise and cloud service environments through compromised M365 credentials. The origin and attribution of DEBULL remain unclear from available reporting, with the designation referring to the campaign itself rather than a specific threat actor group.

TTPs (Tactics, Techniques, Procedures)

The campaign primarily exploits Microsoft's device-code authentication flow (OAuth 2.0 device authorization grant), which maps to T1078 (Valid Accounts) and T1566.002 (Phishing: Spearphishing Link). The attack chain begins with phishing messages using collaboration-themed lures to trick victims into initiating the device code flow. By abusing legitimate Microsoft authentication infrastructure rather than hosting fake credential harvesting pages, the campaign bypasses traditional phishing detection mechanisms. This technique likely involves T1528 (Steal Application Access Token) to obtain OAuth tokens for persistent access to M365 environments. The use of legitimate Microsoft services for authentication provides operational security benefits and complicates detection efforts.

Targets & Patterns

DEBULL targets enterprise organizations and cloud service providers that utilize Microsoft 365 infrastructure. The focus on M365 accounts suggests the campaign seeks access to corporate email, collaboration tools (Teams, SharePoint), and cloud-stored sensitive data. The use of collaboration-themed lures indicates targeting of users likely to respond to messages about shared documents, team invitations, or file access requests—common in modern enterprise workflows. The broad targeting of enterprise and cloud services sectors suggests opportunistic victim selection rather than narrow vertical focus, potentially indicating either initial access broker activity or broad-spectrum credential harvesting for subsequent sale or exploitation. No specific geographic targeting has been identified, suggesting global scope.

Historical Context

Device code flow abuse represents an evolution in phishing tactics observed across multiple campaigns since approximately 2021. This authentication mechanism, designed for devices without web browsers (smart TVs, IoT devices), has been increasingly exploited by threat actors including Storm-0324, Scattered Spider, and other groups targeting cloud environments. DEBULL's June-July 2026 timeframe places it within a broader trend of adversaries shifting from traditional credential phishing to OAuth and token-based attacks against cloud infrastructure. The campaign's reliance on legitimate Microsoft authentication flows rather than fake pages reflects growing sophistication in bypassing security awareness training and technical controls. Without additional attribution data, it remains unclear whether DEBULL represents a new actor, a rebranded operation, or activity by known groups using established techniques.

Defensive Recommendations

  • Monitor for anomalous device code authentication flows (T1078) by analyzing Azure AD/Entra ID sign-in logs for unusual device code grant patterns, particularly from unexpected geolocations or devices
  • Implement Conditional Access policies in Microsoft 365 to restrict or block device code flow authentication for users who do not require this functionality, reducing attack surface
  • Deploy email security controls that detect collaboration-themed lures with embedded device code instructions or links to Microsoft authentication endpoints, flagging suspicious OAuth consent requests
  • Enable continuous access evaluation (CAE) and token protection policies to limit the lifespan and scope of OAuth tokens obtained through compromised authentication flows (T1528)
  • Conduct user awareness training specifically addressing device code phishing techniques, emphasizing that legitimate collaboration requests should not require manual entry of device codes from unsolicited messages