GhostCode attackers abuse device codes to take over Microsoft 365 accounts
GhostCode phishing kit abuses Microsoft's OAuth device authorization flow to harvest tokens, register devices, and steal primary refresh tokens from M365 victims.
eSentire's threat response unit identified in late August 2026 a campaign using the GhostCode kit, which abuses Microsoft's OAuth 2.0 device authorization grant flow: attackers posing as procurement officers lure victims to an NDA-themed HTML file that leads to a device-code phishing page where victims complete MFA for attacker-generated codes. Automated post-authentication activity registered three attacker devices within 78 seconds, enrolled one in Microsoft Intune with enrollment surviving token revocation, and obtained a Primary Refresh Token granting SSO-equivalent M365 access for up to 14 days. eSentire advises restricting device-code authentication via Conditional Access, auditing Entra ID device registrations, and monitoring python-requests user agents after device-code sign-ins.
- Kit abuses OAuth 2.0 device authorization grant meant for TVs and IoT devices
- Victims complete MFA for attacker-generated device codes, yielding valid tokens
- Three devices registered in 78 seconds; one Intune enrollment survived token revocation
- Stolen Primary Refresh Token grants SSO-equivalent M365 access for 14 days by default
- Evasion includes HTML obfuscation, encrypted redirects, and Cloudflare Turnstile
From the original article
3 min read at csoonline.com
Microsoft 365 users are being tricked into handing over access to their accounts by a new phishing kit, GhostCode, that exploits a weakness in a legitimate device authorization flow. Researchers in eSentire’s threat response unit identified the campaign in late August 2026. The kit abuses Microsoft’s OAuth 2.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.