Microsoft 365 users are currently facing threats from a new phishing kit dubbed GhostCode, which takes advantage of vulnerabilities in the device authorization mechanism. Discovered by eSentire’s threat response team in late August 2026, this campaign showcases how attackers can exploit established authentication flows to seize control of user accounts. The implications of such a breach can be severe, not only risking the individual user’s data but also potentially compromising organizational security as a whole.
Understanding the GhostCode Kit
The GhostCode kit leverages Microsoft's OAuth 2.0 device authorization grant flow, originally designed for non-browser-based applications like IoT devices and smart TVs. This technique, referred to as device-code phishing, has been seen in past attacks and serves to facilitate authentication in a way that’s deceptive yet technically sound. A significant aspect of OAuth is its intention to enhance security by allowing third-party applications limited access, but GhostCode twists this premise into a weapon for exploitation.
In practice, GhostCode masquerades as a legitimate device, generating a device code through Microsoft's OAuth framework. Victims are tricked into entering this code on what they believe is a secure Microsoft authentication page. Here’s the thing: this exploitation hinges on trusting what seems like a valid interface. Following the standard process, the attackers capture the resultant authentication tokens after the victims complete multifactor authentication — tokens that allow them to register unauthorized devices and access additional credentials within the compromised individual's Microsoft environment. It’s a stark reminder that even sophisticated security measures like multifactor authentication aren’t foolproof when faced with cunning deception.
Establishing Persistent Access
Once access is gained, GhostCode’s strategy shifts towards establishing a persistent presence within the victim's Microsoft environment. eSentire documented instances where nine API calls were executed in a rapid 78-second window post-authentication. These calls targeted essential services such as Microsoft Intune Enrollment and Azure Active Directory. And this is the part most people overlook: speed and automation play critical roles in the effectiveness of these attacks.
During this timeframe, attackers managed to register three unauthorized devices, each within seconds of the compromised authentication, demonstrating the automated nature of the attack. Such quick actions minimize the chance of detection. Importantly, one of these devices was successfully enrolled in Microsoft's cloud-based device management service, Intune, which preserved its access rights even after the victim's tokens were revoked — the attacker-controlled device remained within the tenant until manually removed. This establishes a dangerous precedent; once an unauthorized device is in place, it can operate like a trojan horse, silently harvesting data long after the initial breach.
Additionally, eSentire reported that attackers extracted a Primary Refresh Token (PRT), a highly privileged credential within a Microsoft identity system. Acquiring a PRT through device code abuse offers threat actors access equivalent to Single Sign-On (SSO) across the entire Microsoft 365 environment. This entry remains until the token expires, which typically lasts 14 days. In these environments, the ramifications can be extensive, compounded by users who inadvertently trust their newly added devices.
Evading Detection
Attackers also employed various evasion tactics to bolster their phishing attempts. They included obfuscating HTML in their lures, encrypting redirects, and implementing checks for bot activity. By utilizing tools like Cloudflare Turnstile, they effectively shielded their phishing pages from detection by security solutions. This illustrates a worrying trend where sophistication in phishing tactics keeps pace with advancements in security technologies. If you’re working in this space, understanding these trends is key to developing effective countermeasures.
Defensive Strategies
In response to these threats, eSentire suggests enhancements in defense measures against such phishing tactics. They recommend restricting Microsoft's device-code authentication via Conditional Access policies and disabling this feature for users who don’t require it. This proactive step removes one of the exploitable avenues and can significantly mitigate risk. Continuous monitoring of the Device Registration Service for unusual multiple device registrations during single sessions can also serve as an alert mechanism for potential attacks. Security teams need to be vigilant about outliers in device enrollment activities.
Furthermore, correlating patterns of successful device-code authentication with any Python-based requests would provide additional security insights. Such ongoing scrutiny helps enhance real-time response capabilities, which is increasingly vital in thwarting rapidly evolving attacks. GhostCode underscores a concerning trend in phishing attacks leveraging device-code authentication to target Microsoft’s systems. This follows previous incidents involving similar tactics, including the “EvilTokens” phishing-as-a-service kit and a series of campaigns reported throughout late 2026 that highlighted vulnerabilities across multiple threat actor clusters.
Future Outlook
The rise of sophisticated phishing techniques like GhostCode raises pressing questions about the resilience of current cybersecurity measures. As attackers continue to refine their tactics, organizations must grapple with the dual challenge of maintaining user convenience while ensuring robust security protections. This is more significant than it looks. The fallout from a successful breach can ripple throughout an organization, impacting everything from financial stability to customer trust.
The lessons from GhostCode are clear. Continuous education around phishing, coupled with technical restrictions tailored to specific user needs, is essential. As cyber threats evolve, so too must our defensive strategies. Cybersecurity isn’t just about implementing tools; it’s about fostering a culture of vigilance and adaptability that protects users and organizations alike.
This article first appeared on Computerworld.
