GhostCode Abuses Microsoft Entra Device Enrollment to Maintain Access After Token Revocation
eSentire exposes GhostCode, a device-code phishing kit that abuses Microsoft Entra device enrollment to persist even after stolen tokens are revoked.
73
Vendor
eSentire
- Mentions · 7d0
- Mentions · 30d0
- All mentions3
- First seenAug 19, 2026
- Last mentionedSep 16, 2026
Timeline
3 articles · newest firstThreatsDay: Gogs 10.0 RCE, n8n Workflow-to-RCE, $10M Reward, GLM
Hacker News ThreatsDay roundup: Defender BTR.sys driver abuse, DoJ charges 17 Mabna Institute members over IRGC-linked intrusions, Grandoreiro sideloading, OpenAI monitoring.
48
MaaS Campaign Combines ClickFix, ErrTraffic and Cruciferra
eSentire uncovered a malware-as-a-service campaign pairing ClickFix social-engineering lures with the ErrTraffic and Cruciferra malware families.
35
Appears with
- Microsoftvendor · 2
- U.S. Department of Stateorganization · 1
- Vidar Stealerthreat actor · 1
- WatchGuardvendor · 1
- BJ's Wholesale Cluborganization · 1
- Check Pointvendor · 1
- Cruciferramalware · 1
- ErrTrafficthreat actor · 1
- BJ's Wholesale Clubvictim · 1
- Acronisvendor · 1
- Islamic Revolutionary Guard Corpsthreat actor · 1
- Microsoft Defenderproduct · 1
- Remus Stealerthreat actor · 1
- Cruciferrathreat actor · 1
- Grandoreirothreat actor · 1
- U.S. Department of Justiceorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.