GhostCode Abuses Microsoft Entra Device Enrollment to Maintain Access After Token Revocation
eSentire exposes GhostCode, a device-code phishing kit that abuses Microsoft Entra device enrollment to persist even after stolen tokens are revoked.
eSentire's Threat Response Unit observed GhostCode campaigns in late August 2026, using BEC-style social engineering that impersonated procurement staff, including BJ's Wholesale Club, via Salesforce contact forms. Victims received password-protected HTML lures disguised as a FlipBook document portal, with junk-data padding, HTML comment injection, and AES-256-GCM encrypted redirects gated by anti-bot checks. The kit exploits the OAuth 2.0 device authorization grant, prompting victims to approve real Microsoft device-code sign-ins with MFA. Within 78 seconds of approval, attackers registered three Entra devices and obtained a Primary Refresh Token, so rogue device registrations persist even after session token revocation.
- Device-code phishing turns one MFA-approved login into attacker-controlled Entra devices
- Operators impersonated BJ's Wholesale Club procurement staff via Salesforce contact forms
- Over 30 lookalike mail-enabled domains registered for BEC staging infrastructure
- Password-gated HTML hides phishing URL behind PBKDF2-derived AES-256-GCM decryption
- Rogue Intune enrollments with Primary Refresh Tokens persisted after token revocation
- ATT&CK
- T1566.001 Spearphishing AttachmentT1621 Multi-Factor Authentication Request GenerationT1098.005 Device RegistrationT1550.001 Application Access TokenT1090.003 Multi-hop Proxy
- Threat actors
- GhostCode
- Victims
- BJ's Wholesale Club
- Organizations
- BJ's Wholesale Club
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | bjssourcing.com | suggests scale. eSentire linked the observed sender domain, bjssourcing[.]com, to more than 30 recently registered lookalike domains im |
From the original article
4 min read at gbhackers.com
A newly identified device-code phishing kit dubbed GhostCode exploits Microsoft Entra device enrollment to maintain access after stolen tokens are revoked. GhostCode begins with business-email social engineering rather than a conventional credential-harvesting page.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.