InfoSecBulletin Cybersecurity for mankind
Cybersecurity experts are highlighting an ongoing phishing effort that is aiming at Microsoft 365 accounts in over 340 organizations in the U.S., Canada, Australia, New Zealand, and Germany.
The event, according to Huntress, was first seen on February 19, 2026. After that, more cases appeared quickly. This campaign uses Cloudflare Workers to send traffic to sessions stored on a platform called Railway, making it a tool for stealing credentials.
Cloudflare Unveils Emergency WAF Ruleset Update on Brotli flaw
Daily Cyber security update for 26.10. 2026
The Washington Post report
Ex-DOGE AI startup Cathedral Breaches Anthropic Internal Systems within 12 Hours
Daily Cyber security update for 25. 10. 2026
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
“What also makes this campaign unusual is not just the device code phishing techniques involved, but the variety of techniques observed,” the company said. “Construction bid lures, landing page code generation, DocuSign impersonation, voicemail notifications, and abuse of Microsoft Forms pages are all hitting the same victim pool through the same Railway.com IP infrastructure.”
Device code phishing is a way hackers misuse the OAuth device authorization process. This gives them lasting access tokens. They can use these tokens to take over victim accounts. What’s important is that these tokens stay active even if the victim changes their password.
Threat actor requests a device code from the identity provider (e.g, Microsoft Entra ID) via the legitimate device code API.
The service responds with a device code.
Threat actor creates a persuasive email and sends it to the victim, urging them to visit a sign-in page (“microsoft[.]com/devicelogin”) and enter the device code.
Once the victim puts in the given code, their login info, and the two-factor authentication (2FA) code, the service makes an access token and a refresh token for them.
“Once the user has fallen victim to the phish, their authentication generates a set of tokens that now live at the OAuth token API endpoint and can be retrieved by providing the correct device code,” Huntress explained. “The attacker, of course, knows the device code because it was generated by the initial cURL request to the device code login API.”
“And while that code is useless by itself, once the victim has been tricked into authenticating, the resulting tokens now belong to anyone who knows which device code was used in the original request.”
The first notice of device code phishing came from Microsoft and Volexity in February 2025. Later reports were made by Amazon Threat Intelligence and Proofpoint. Several groups linked to Russia, known as Storm-2372, APT29, UTA0304, UTA0307, and UNK_AcademicFlare, are blamed for these attacks. Click here to read the full report.
