GhostCode attackers abuse device codes to take over Microsoft 365 accounts
GhostCode phishing kit abuses Microsoft's OAuth device authorization flow to harvest tokens, register devices, and steal primary refresh tokens from M365 victims.
5
Stories per day · 30 days
2 RSS
4 stories, newest first · one card per story
Stories tagged #esentire
GhostCode Phishing Kit Bypasses Microsoft 365 MFA to Hijack Accounts in 78 Seconds
eSentire identified GhostCode, a phishing kit abusing Microsoft 365 OAuth device-code sign-in to steal tokens and take over accounts in seconds.
6
GhostCode Abuses Microsoft Entra Device Enrollment to Maintain Access After Token Revocation
eSentire exposes GhostCode, a device-code phishing kit that abuses Microsoft Entra device enrollment to persist even after stolen tokens are revoked.
9
MaaS Campaign Combines ClickFix, ErrTraffic and Cruciferra
eSentire uncovered a malware-as-a-service campaign pairing ClickFix social-engineering lures with the ErrTraffic and Cruciferra malware families.
2