GhostCode: The Emerging Phishing Threat Exploiting Microsoft 365 Device Authorization Flows

In a significant escalation of identity-based cyberattacks, security researchers have uncovered a sophisticated new phishing kit dubbed "GhostCode." This tool is specifically designed to subvert legitimate Microsoft 365 authentication processes, allowing threat actors to bypass multi-factor authentication (MFA), hijack user sessions, and establish a long-term, persistent presence within corporate cloud environments. The discovery, made by eSentire’s Threat Response Unit (TRU) in late August 2026, highlights a growing trend where attackers no longer seek to steal passwords, but rather the digital tokens that grant access to modern enterprise applications.

The GhostCode campaign represents a refined evolution of "device-code phishing," a technique that exploits the OAuth 2.0 device authorization grant flow. While this flow was originally engineered by Microsoft to facilitate ease of use for devices with limited input capabilities, it has increasingly become a blind spot for security teams and a lucrative target for cybercriminals. By manipulating this legitimate mechanism, GhostCode allows attackers to enroll their own rogue devices into a victim’s tenant, effectively turning a single successful phishing lure into a full-scale organizational compromise.

The Mechanics of the Device Code Abuse

To understand the threat posed by GhostCode, one must first understand the legitimate technology it subverts. The OAuth 2.0 device authorization grant flow is a standard protocol designed for "input-constrained" devices. These include smart TVs, printers, IoT hardware, and various terminal-based applications that lack a full web browser or a keyboard suitable for complex password entry. In a standard scenario, such a device displays a short, alphanumeric code and directs the user to a Microsoft URL (such as microsoft.com/devicelogin) on a separate device, like a smartphone or laptop. Once the user enters the code and authenticates on their browser, the original device is granted an access token.

GhostCode weaponizes this convenience. Instead of a smart TV requesting access, the phishing kit poses as a legitimate Microsoft-affiliated application or service. The attacker initiates the flow, receives a code from Microsoft, and then delivers that code to the victim via a social engineering lure. When the victim enters the code into the official Microsoft portal, they believe they are performing a routine authorization. In reality, they are authorizing the attacker’s infrastructure to act on their behalf.

Because the victim is logging into the official Microsoft website, they encounter all the standard security prompts, including multi-factor authentication (MFA). To the user, the process looks entirely legitimate. However, once the MFA challenge is completed, the resulting authentication tokens are not sent to the user’s device; they are intercepted by the GhostCode kit. This "adversary-in-the-middle" approach renders traditional MFA protections insufficient, as the user themselves provides the necessary second factor directly to the legitimate service provider, unknowingly validating the attacker’s session.

Social Engineering and the Initial Infection Vector

The success of GhostCode relies heavily on a highly targeted social engineering strategy. In the campaigns observed by eSentire, the threat actors did not rely on broad, poorly drafted spam emails. Instead, they adopted the persona of procurement officers or business representatives. The initial contact often occurred through a legitimate web contact form on a target company’s website—a tactic designed to bypass traditional email security filters that might flag unsolicited external messages.

The attackers would initiate a conversation regarding a potential business deal or a procurement inquiry. Once they established a rapport with a target employee, the conversation would be moved to the exchange of sensitive documents. The "hook" in the GhostCode campaign was an NDA-themed HTML file. Victims were told they needed to review and sign the non-disclosure agreement before proceeding with the business transaction.