GhostCode Abuses Microsoft Entra Device Enrollment to Maintain Access After Token Revocation
eSentire exposes GhostCode, a device-code phishing kit that abuses Microsoft Entra device enrollment to persist even after stolen tokens are revoked.
73
Victim
BJ's Wholesale Club
- Mentions · 7d0
- Mentions · 30d0
- All mentions1
- First seenSep 16, 2026
- Last mentionedSep 16, 2026
Timeline
1 articles · newest firstAppears with
- Microsoft Intuneproduct · 1
- Salesforceproduct · 1
- eSentirevendor · 1
- GhostCodethreat actor · 1
- Microsoftvendor · 1
- BJ's Wholesale Cluborganization · 1
- Microsoft Entra IDproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.