InfoSecBulletin Cybersecurity for mankind
Cybersecurity experts are highlighting an ongoing phishing effort that is aiming at Microsoft 365 accounts in over 340 organizations in the U.S., Canada, Australia, New Zealand, and Germany.
The event, according to Huntress, was first seen on February 19, 2026. After that, more cases appeared quickly. This campaign uses Cloudflare Workers to send traffic to sessions stored on a platform called Railway, making it a tool for stealing credentials.
LastPass says hackers stole customer data via Klue, supply chain breach
New Apple Exploit Bypasses Boot Defenses, Possibly Affects Millions of iPhones Worldwide
India’s Tata Electronics hit by cyber breach: Hacker target 630 GB record
Anthropic’s Mythos reportedly broke NSA classified systems in hours
OpenAI New Method “Deployment Simulation” Predicts AI Risks Before Deployment
AryStinger botnet infected thousands of D-Link routers globally
Hacker suspected of sending alerts across Brazil
CyberSentinel AI features 33 security tools like Nmap, SQLMap, and ZAP, utilizing Claude and GPT
Barracuda hosts Dhaka roundtable on cyber resilience
CISA Alerts Fortinet Users as FortiBleed Affects 86,644 FortiGate Devices
“What also makes this campaign unusual is not just the device code phishing techniques involved, but the variety of techniques observed,” the company said. “Construction bid lures, landing page code generation, DocuSign impersonation, voicemail notifications, and abuse of Microsoft Forms pages are all hitting the same victim pool through the same Railway.com IP infrastructure.”
Device code phishing is a way hackers misuse the OAuth device authorization process. This gives them lasting access tokens. They can use these tokens to take over victim accounts. What’s important is that these tokens stay active even if the victim changes their password.
Threat actor requests a device code from the identity provider (e.g, Microsoft Entra ID) via the legitimate device code API.
The service responds with a device code.
Threat actor creates a persuasive email and sends it to the victim, urging them to visit a sign-in page (“microsoft[.]com/devicelogin”) and enter the device code.
Once the victim puts in the given code, their login info, and the two-factor authentication (2FA) code, the service makes an access token and a refresh token for them.
“Once the user has fallen victim to the phish, their authentication generates a set of tokens that now live at the OAuth token API endpoint and can be retrieved by providing the correct device code,” Huntress explained. “The attacker, of course, knows the device code because it was generated by the initial cURL request to the device code login API.”
“And while that code is useless by itself, once the victim has been tricked into authenticating, the resulting tokens now belong to anyone who knows which device code was used in the original request.”
The first notice of device code phishing came from Microsoft and Volexity in February 2025. Later reports were made by Amazon Threat Intelligence and Proofpoint. Several groups linked to Russia, known as Storm-2372, APT29, UTA0304, UTA0307, and UNK_AcademicFlare, are blamed for these attacks. Click here to read the full report.
