campaign-dcl-05-2026 active Device Code Phishing / PhaaS
Device Code Lab (DCL) — PhaaS Infrastructure
First seen
Last updated
Campaign Summary
Device Code Lab (DCL) is a Phishing-as-a-Service platform targeting Microsoft Entra ID via OAuth device code flow abuse. Infrastructure spans HostPapa, DataWagon, DigitalOcean, and AWS hosting; front-end lure pages are delivered via Cloudflare Workers and compromised third-party domains. Post-exploitation capability includes a full Outlook Web App clone, Exchange connector injection, tenant-wide transport rule creation, inbox listening, email address harvesting, SMTP lure sending, and SVG attachment generation with explicit MDE bypass. The platform is in active operational use.
Related Research
Indicators of Compromise
14 IPs · 29 domains - defanged for safe display and export
IP Addresses
HostPapa AS36352 6 entries
107[.]172[.]151[.]3
67[.]215[.]253[.]44
23[.]94[.]232[.]218
23[.]94[.]232[.]236
192[.]3[.]225[.]100
192[.]3[.]225[.]103
DataWagon AS398101 2 entries
172[.]81[.]130[.]130
104[.]219[.]239[.]125
DigitalOcean AS14061 — Dashboard panel 1 entries
165[.]245[.]167[.]52
Amazon AS14618 — Likely database node; MSSQL 1433 open 1 entries
3[.]231[.]33[.]242
Cloudflare — shared, low pivot value 4 entries
104[.]21[.]78[.]8
172[.]67[.]214[.]105
172[.]67[.]211[.]222
104[.]21[.]85[.]226
Domains
DCL Backend 2 entries
api[.]controltkeusa[.]com
api[.]babalfashion[.]com
DCL Backend — active campaign 1 entries
api[.]skysharegroup[.]com
DCL Console 13 entries
babalfashion[.]com
skysharegroup[.]com
skysharesgroup[.]org
miami-techinc[.]com
www[.]miami-techinc[.]com
petsawise[.]com
www[.]petsawise[.]com
brokerslatinos[.]com
docspacepro[.]com
www[.]docspacepro[.]com
kraftmansplay[.]com
mail[.]babalfashion[.]com
idos-claim[.]live
DCL Console — TLS cert from miami-techinc 2 entries
www[.]brokerslatinos[.]com
seasfax[.]com
DCL Console — now offline 1 entries
docseef[.]com
DCL Console — TLS cert from kraftmansplay 1 entries
browsegadgetzone[.]sa[.]com
DCL Console — compromised host; TLS cert from miami-techinc 3 entries
secure[.]bdwebhub[.]com
secure[.]einco[.]com[.]br
secure[.]technebula[.]site
DCL Console — crypto-themed 1 entries
011pump[.]fun
Front-end Lure Page 3 entries
bluebellscare[.]com
bluecollaracademy[.]us
guiadahospedagem[.]com[.]br
Front-end Lure Page — compromised host 1 entries
tgcwuzcq4q[.]vibrazil[.]com
Cloudflare Worker Delivery 1 entries
sgttommy[.]workers[.]dev