DEBULL Cloudflare Workers phishing lure calling debull.app device-code broker

Duo Tech@duotech

•updated Jul 9, 2026•0•0•10

Detects HTTP traffic originating from external sources that contains response body patterns associated with a DEBULL-themed phishing lure. This rule specifically identifies content indicators related to device-code broker phishing, where a user is tricked into navigating to a malicious URL (debull.app) to authorize access or provide credentials.