DEBULL Tooling Abuses Microsoft Device-Code Flow to Target M365 Accounts

A recent phishing campaign exploiting the Microsoft 365 device-code flow tricked users into granting unauthorized access to their accounts through collaboration-themed lures. This clever attack bypasses traditional phishing tactics, leveraging the legitimate device login experience to steal credentials. The timing of this campaign, occurring in late June through early July, underscores the evolving tactics cybercriminals use to exploit trusted systems, highlighting the urgent need for enhanced security awareness and multi-factor authentication.