InfoSecBulletin Cybersecurity for mankind
Cybersecurity experts are highlighting an ongoing phishing effort that is aiming at Microsoft 365 accounts in over 340 organizations in the U.S., Canada, Australia, New Zealand, and Germany.
The event, according to Huntress, was first seen on February 19, 2026. After that, more cases appeared quickly. This campaign uses Cloudflare Workers to send traffic to sessions stored on a platform called Railway, making it a tool for stealing credentials.
Singapore Approves 200MW Data-Centre Expansion Under Second Call
Chameleon SEO Poisoning
Hackers poison Bing and Google search results to deliver phishing banking pages
Mysterious AI model “Ox Alpha” with free 100 trillion tokens a day for coders
After BDJobs, Directorate of Secondary and Higher Education 390k data surfaced online
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“What also makes this campaign unusual is not just the device code phishing techniques involved, but the variety of techniques observed,” the company said. “Construction bid lures, landing page code generation, DocuSign impersonation, voicemail notifications, and abuse of Microsoft Forms pages are all hitting the same victim pool through the same Railway.com IP infrastructure.”
Device code phishing is a way hackers misuse the OAuth device authorization process. This gives them lasting access tokens. They can use these tokens to take over victim accounts. What’s important is that these tokens stay active even if the victim changes their password.
Threat actor requests a device code from the identity provider (e.g, Microsoft Entra ID) via the legitimate device code API.
The service responds with a device code.
Threat actor creates a persuasive email and sends it to the victim, urging them to visit a sign-in page (“microsoft[.]com/devicelogin”) and enter the device code.
Once the victim puts in the given code, their login info, and the two-factor authentication (2FA) code, the service makes an access token and a refresh token for them.
“Once the user has fallen victim to the phish, their authentication generates a set of tokens that now live at the OAuth token API endpoint and can be retrieved by providing the correct device code,” Huntress explained. “The attacker, of course, knows the device code because it was generated by the initial cURL request to the device code login API.”
“And while that code is useless by itself, once the victim has been tricked into authenticating, the resulting tokens now belong to anyone who knows which device code was used in the original request.”
The first notice of device code phishing came from Microsoft and Volexity in February 2025. Later reports were made by Amazon Threat Intelligence and Proofpoint. Several groups linked to Russia, known as Storm-2372, APT29, UTA0304, UTA0307, and UNK_AcademicFlare, are blamed for these attacks. Click here to read the full report.
