DEBULL: Storm-2372-Style Microsoft Device-Code Phishing With GraphSpy Post-Exploitation

A sophisticated Microsoft 365 device-code phishing campaign leveraged the DEBULL PhaaS framework and GraphSpy post-exploitation tooling to evade detection, enable rapid lure deployment, and facilitate attacker-controlled session hijacking through legitimate Microsoft authentication flows.