GhostCode Phishing Kit Bypasses Microsoft 365 MFA to Hijack Accounts in 78 Seconds
eSentire identified GhostCode, a phishing kit abusing Microsoft 365 OAuth device-code sign-in to steal tokens and take over accounts in seconds.
eSentire analysts identified GhostCode in late August, a phishing kit that uses business contact-form messages and an NDA pretext to deliver a password-protected HTML attachment leading victims to a Microsoft device-code sign-in. Victims authenticate on legitimate Microsoft pages, letting the kit obtain a Primary Refresh Token in 32 seconds and register three devices in 78 seconds, with residential proxies matching the victim's location. The kit hides its redirect with encrypted addresses, junk data, and scanner-filtering challenges, and uses GHOSTnet-linked infrastructure during device enrolment. eSentire recommends blocking device-code authentication via Conditional Access, invalidating tokens, and reviewing newly enrolled devices.
- Abuses OAuth device authorization via the Microsoft Authentication Broker application ID
- Password-protected HTML attachment hides its encrypted redirect until the password is entered
- Primary Refresh Token harvested in 32 seconds; three devices registered in 78 seconds
- Residential proxies matching victim location weaken location-based Microsoft alerts
- Enrolled devices persist until admins explicitly disable or remove them
- ATT&CK
- T1566.001 Spearphishing AttachmentT1528 Steal Application Access TokenT1078.004 Valid Accounts: Cloud AccountsT1550.001 Application Access Token
- Vendors
- Microsoft
- Products
- Microsoft 365
- Threat actors
- GHOSTnet
- Malware
- GhostCode
- Organizations
- eSentire
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | bjssourcing.com | rs of Compromise (IoCs):- Type Indicator Description Domain bjssourcing[.]com Lookalike sender domain used in the procurement-officer p |
| domain | elitechiropracticandrehab.com | crypted redirect destination Domain account-access-rc3uenqi.elitechiropracticandrehab[.]com Device-code phishing server hosted under a likely comprom |
| domain | flipbookonlinevault.com | ent used as the document-sharing lure URL hxxps://chartered.flipbookonlinevault[.]com/scanna/200e61bfe54c92fb720c77c3a1661bc0/b5ea87c2ddac3aa14 |
| domain | greenlightdlstribution.com | ender domain used in the procurement-officer pretext Domain greenlightdlstribution[.]com Related impersonation domain registered during the campai |
| domain | voewo.com | tered during the campaign period Email address jeremyarcher@voewo[.]com Disposable address associated with registration of a rela |
| ipv4 | 151.225.227.193 | 4 Residential proxy IP observed during token use IP address 151.225.227[.]193 Residential proxy IP observed during token use IP address |
| ipv4 | 176.253.248.175 | 3 Residential proxy IP observed during token use IP address 176.253.248[.]175 Residential proxy IP observed during token use IP address |
| ipv4 | 5.230.71.51 | 4 Residential proxy IP observed during token use IP address 5.230.71[.]51 GHOSTnet-associated IP observed during final Intune enrol |
| ipv4 | 81.96.174.54 | 9 Residential proxy IP observed during token use IP address 81.96.174[.]54 Residential proxy IP observed during token use IP address |
| ipv4 | 82.33.39.74 | uring token use and post-authentication activity IP address 82.33.39[.]74 Residential proxy IP observed during token use IP address |
| ipv4 | 86.132.13.219 | 2 Residential proxy IP observed during token use IP address 86.132.13[.]219 Residential proxy IP observed during token use IP address |
| ipv4 | 90.215.55.70 | 4 Residential proxy IP observed during token use IP address 90.215.55[.]70 Residential proxy IP observed during token use IP address |
| ipv4 | 92.40.47.84 | 0 Residential proxy IP observed during token use IP address 92.40.47[.]84 Residential proxy IP observed during token use IP address |
| ipv4 | 94.9.97.142 | 5 Residential proxy IP observed during token use IP address 94.9.97[.]142 Residential proxy IP observed during token use IP address |
| md5 | 200e61bfe54c92fb720c77c3a1661bc0 | lure URL hxxps://chartered.flipbookonlinevault[.]com/scanna/200e61bfe54c92fb720c77c3a1661bc0/b5ea87c2ddac3aa141bc6794b8993d1e43bd064eaae591719612becea0d |
| sha256 | b5ea87c2ddac3aa141bc6794b8993d1e43bd064eaae591719612becea0d106d7 | okonlinevault[.]com/scanna/200e61bfe54c92fb720c77c3a1661bc0/b5ea87c2ddac3aa141bc6794b8993d1e43bd064eaae591719612becea0d106d7 Decrypted relay URL used for tracking, filtering, and redir |
| url | https://chartered.flipbookonlinevault.com/scanna/200e61bfe54c92fb720c77c3a1661bc0/b5ea87c2ddac3aa141bc6794b8993d1e43bd064eaae591719612becea0d106d7 | ected HTML attachment used as the document-sharing lure URL hxxps://chartered.flipbookonlinevault[.]com/scanna/200e61bfe54c92fb720c77c3a1661bc0/b5ea87c2ddac3aa141bc6794b8993d1e43bd064eaae591719612becea0d106d7 Decrypted relay URL used for tracking, filtering, and red |
From the original article
5 min read at cybersecuritynews.com
GhostCode is a newly identified phishing kit that turns a normal Microsoft 365 sign-in into an account takeover. It does not need to steal a password. Instead, it persuades people to approve a login that gives criminals access to their work account.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.