GhostCode Phishing Kit Hijacks Microsoft 365 Accounts
A new phishing kit called GhostCode is exploiting Microsoft 365's device authorization flow to hijack corporate accounts and establish persistent access that bypasses token revocation.
Security researchers at eSentire discovered a campaign in late August 2026 utilizing a new phishing kit named GhostCode. The kit exploits Microsoft's OAuth 2.0 device authorization grant flow, a feature meant to help browserless devices like smart TVs and printers authenticate. Attackers trick victims into entering a generated device code on Microsoft's official login page. Once the victim completes multifactor authentication, the attacker-controlled device receives the authentication tokens.
The attack begins with social engineering, often using an HTML file themed around a non-disclosure agreement. Once the victim authorizes the code, GhostCode executes a highly automated sequence. In one observed incident, the kit made nine successful API calls across Azure Active Directory, Microsoft Graph, the Device Registration Service, and Microsoft Intune Enrollment in just 78 seconds. During this brief window, the attackers registered three separate devices at 28, 53, and 77 seconds post-authentication.
The third registered device was enrolled in Microsoft Intune, a cloud-based management service. This enrollment is particularly dangerous because it survives token revocation, meaning the rogue device remains in the network until administrators manually delete it. Furthermore, the attackers secured a Primary Refresh Token (PRT). According to eSentire, this credential grants "SSO-equivalent access to the victim's entire M365 environment" for its default 14-day lifespan, bypassing any service not protected by strict device-compliance policies.
To defend against GhostCode, IT administrators should restrict or disable the device-code authentication flow using Conditional Access policies. Practitioners must also monitor the Device Registration Service for multiple registrations within a single non-interactive session. eSentire recommends auditing Entra ID for suspicious naming patterns and watching for subsequent API requests utilizing the python-requests user agent, which indicates automated post-compromise activity.
This is our own summary of reporting by Computerworld AI
