InfoSecBulletin Cybersecurity for mankind
Cybersecurity experts are highlighting an ongoing phishing effort that is aiming at Microsoft 365 accounts in over 340 organizations in the U.S., Canada, Australia, New Zealand, and Germany.
The event, according to Huntress, was first seen on February 19, 2026. After that, more cases appeared quickly. This campaign uses Cloudflare Workers to send traffic to sessions stored on a platform called Railway, making it a tool for stealing credentials.
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“What also makes this campaign unusual is not just the device code phishing techniques involved, but the variety of techniques observed,” the company said. “Construction bid lures, landing page code generation, DocuSign impersonation, voicemail notifications, and abuse of Microsoft Forms pages are all hitting the same victim pool through the same Railway.com IP infrastructure.”
Device code phishing is a way hackers misuse the OAuth device authorization process. This gives them lasting access tokens. They can use these tokens to take over victim accounts. What’s important is that these tokens stay active even if the victim changes their password.
Threat actor requests a device code from the identity provider (e.g, Microsoft Entra ID) via the legitimate device code API.
The service responds with a device code.
Threat actor creates a persuasive email and sends it to the victim, urging them to visit a sign-in page (“microsoft[.]com/devicelogin”) and enter the device code.
Once the victim puts in the given code, their login info, and the two-factor authentication (2FA) code, the service makes an access token and a refresh token for them.
“Once the user has fallen victim to the phish, their authentication generates a set of tokens that now live at the OAuth token API endpoint and can be retrieved by providing the correct device code,” Huntress explained. “The attacker, of course, knows the device code because it was generated by the initial cURL request to the device code login API.”
“And while that code is useless by itself, once the victim has been tricked into authenticating, the resulting tokens now belong to anyone who knows which device code was used in the original request.”
The first notice of device code phishing came from Microsoft and Volexity in February 2025. Later reports were made by Amazon Threat Intelligence and Proofpoint. Several groups linked to Russia, known as Storm-2372, APT29, UTA0304, UTA0307, and UNK_AcademicFlare, are blamed for these attacks. Click here to read the full report.
