GhostCode attackers abuse device codes to take over Microsoft 365 accounts
GhostCode phishing kit abuses Microsoft's OAuth device authorization flow to harvest tokens, register devices, and steal primary refresh tokens from M365 victims.
65
Threat actor
GhostCode
- Mentions · 7d0
- Mentions · 30d0
- All mentions2
- First seenSep 16, 2026
- Last mentionedSep 18, 2026
Timeline
2 articles · newest firstGhostCode Abuses Microsoft Entra Device Enrollment to Maintain Access After Token Revocation
eSentire exposes GhostCode, a device-code phishing kit that abuses Microsoft Entra device enrollment to persist even after stolen tokens are revoked.
73
Appears with
- Microsoftvendor · 2
- Microsoft Intuneproduct · 2
- Entra IDproduct · 1
- BJ's Wholesale Cluborganization · 1
- KnowBe4organization · 1
- eSentirevendor · 1
- eSentireorganization · 1
- BJ's Wholesale Clubvictim · 1
- Microsoft 365product · 1
- Microsoft Entra IDproduct · 1
- Salesforceproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.