Device Code Phishing: Legitimate Authentication Becomes the…

Device code phishing exploits Microsoft's legitimate OAuth flow to bypass MFA. Low-cost PhaaS kits like DEBULL and ARToken have industrialized the technique, turning cloud identity architecture against users.

The OAuth 2.0 Device Authorization Grant (RFC 8628), designed for input-constrained devices, has been weaponized at industrial scale in the first half of 2026. By July, the DEBULL campaign demonstrates how low-cost PhaaS kits transform this legitimate authentication into a systematic MFA bypass. This is not a software vulnerability: it is the cloud identity architecture itself repurposed against users.

Key Takeaways

Device code phishing bypasses MFA because the user authenticates the attacker's device directly on microsoft.com/devicelogin, Microsoft's legitimate domain.
Access and refresh tokens remain valid even after a password reset, requiring explicit revocation to cut off access.
Push Security detected a 15x to 37.5x increase in device code phishing pages in 2026, with over 14 distinct kits identified in circulation.
The ARToken panel exposes over 80 API endpoints for post-compromise operations, including PRT persistence, BEC, and SharePoint exfiltration.

How the Weaponized Flow Works

The attack begins with a request to Microsoft's OAuth 2.0 Device Authorization Grant flow, which the attacker generates automatically. They obtain a user_code and a device_code, then deliver the code to the victim via phishing email using payment or shared-folder pretexts. The victim authenticates on microsoft.com/devicelogin, enters the code, completes any MFA challenge: the token is issued to the attacker's device, not the victim's.

No password theft is required. Authentication occurs entirely on legitimate Microsoft infrastructure, rendering URL-based malicious detection useless. According to Huntress, cited by The Hacker News:

"Device code phishing doesn't hack its way in. It uses a legitimate authentication flow to walk right through the front door, with no password required, MFA bypassed, and session tokens handed straight to the attacker."

The DEBULL broker, active from June to July 2026, uses a compromised Croatian rental site as an orchestrator. It bears Turkish markers and is assessed as a reusable PhaaS platform paired with GraphSpy or a derivative for post-exploitation.

From Tradecraft to Commodity: The Maturation of the PhaaS Market

The technical lineage reconstructs clearly. Storm-2372, documented by Microsoft in February 2025, was the first actor to systematically employ this tradecraft. In February 2026, EvilTokens industrialized the model: Sekoia documented over 500 domains on Cloudflare Workers and more than 1,000 phishing pages, with a pricing model of $1,500 one-time plus $500 monthly.

Cisco Talos subsequently revealed ARToken, a panel sharing an identical API contract with EvilTokens — including the POST /api/device/start pattern — but exposing extended functionality. Over 80 API endpoints manage device code phishing, persistence via Primary Refresh Token, email access, BEC operations, and SharePoint exfiltration. A 900-second (15-minute) countdown forces real-time coordination with the victim to ensure phishing success.

The Huntress campaign, detected between February and March 2026, hit over 340 organizations across five countries: the United States, Canada, Australia, New Zealand, and Germany. 84% of authentication events were attributable to three IP addresses hosted on Railway, with Cloudflare distribution.

Why Traditional Controls Fail

The architectural problem is twofold. First: authentication occurs on legitimate Microsoft domains, so URL-based anti-phishing filters and web gateways detect no anomalies. Second: obtained tokens persist beyond password changes, since revocation requires explicit administrative action on active tokens.

Traditional indicators of compromise — suspicious IPs, stolen passwords, anomalous browser behavior — do not apply. The "suspicious" IP is the user's legitimate one; the "browser" is the input-constrained device authorized by the OAuth flow. Detection must shift to patterns: repeated polling from Railway IPs, anomalous device registration, authentication timings incompatible with the user profile.

Push Security underscores the risk distribution: "Microsoft is, as always, much more heavily targeted at scale now than any other app." The phenomenon is not limited to a single actor: Tycoon 2FA, a known MFA-focused phishing-as-a-service platform, adopted device code phishing after law enforcement disrupted its previous infrastructure.

What to Do Now

Organizations using Microsoft 365 must redefine their threat model assumptions.

Monitor the flow, not just the content. Defenses must detect OAuth polling patterns from infrastructure-as-a-service IPs (Railway, Cloudflare Workers) and correlate device registration with historical user profiles. A login from a corporate smartphone is one thing; a registration from a cloud container with mechanical polling timing is another.

Audit active tokens, not just passwords. Because tokens remain valid after a password reset, incident response procedures must include explicit revocation of OAuth tokens and Primary Refresh Tokens, not just credential rotation.

Analyze emails for operational pretexts, not malicious links. The payment and shared-folder pretexts used by DEBULL contain no suspicious URLs: the payload is the alphanumeric code to be entered on a legitimate site. Defense shifts to verifying payment requests through alternative channels.

Segment response by business function. Finance, HR, logistics, and accounts payable are the preferred targets of BEC operations. Controls must be stricter for these functions, with out-of-band verification of transactions and document sharing.

The Limit of the Architecture, Not the Product

Device code phishing is not a patchable flaw: it is the result of an authentication flow designed for usability, not resilience against determined actors. Commoditization via affordable PhaaS kits has lowered the barrier to entry to levels that make the threat recurring and scalable, not episodic. Organizations that continue to measure identity security by the presence of MFA are monitoring the wrong parameter.

MFA is not dead. The boundary between legitimate authentication and unauthorized access has simply become invisible to traditional tools.

Sources

Information verified against cited sources and current as of publication.

Sources

Sources and references