GhostCode Phishing Kit Bypasses Microsoft 365 MFA to Hijack Accounts in 78 Seconds
eSentire identified GhostCode, a phishing kit abusing Microsoft 365 OAuth device-code sign-in to steal tokens and take over accounts in seconds.
72
Malware
GhostCode
- Mentions · 7d0
- Mentions · 30d0
- All mentions1
- First seenSep 16, 2026
- Last mentionedSep 16, 2026
Timeline
1 articles · newest firstAppears with
- Microsoft 365product · 1
- eSentireorganization · 1
- GHOSTnetthreat actor · 1
- Microsoftvendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.