Executive Summary
Between June and July 2026, a major phishing campaign was identified utilizing a sophisticated Phishing-as-a-Service (PaaS) framework called DEBULL. The campaign employs Storm-2372-style tradecraft, using malicious collaboration lures to trick users into the legitimate Microsoft device login experience. This allows attackers to generate and poll Microsoft Authentication Broker tokens, effectively bypassing traditional MFA and password-based defenses.
Technical analysis of the DEBULL backend reveals a modular PHP framework including 'CloakGuard' for page deployment, supporting custom HTML/JS templates and Cloudflare Workers integration. Post-authentication, the threat actors utilize GraphSpy or derived tools for Entra ID and Microsoft 365 exploitation, often leaving behind a 'GraphSpy-Device' object. The infrastructure uses geo-plausible data-center egress to avoid impossible-travel alerts.
This threat is significant because it packages advanced identity-theft tradecraft into a reusable, commercially available platform. The use of legitimate Microsoft infrastructure for the authentication phase and compromised business websites for staging makes these lures highly effective and difficult for standard security filters to detect.