GhostCode: The Emerging Phishing Threat Exploiting Microsoft 365 Device Authorization Flows

When the victim opened the HTML file, they were not presented with a document. Instead, the file contained obfuscated code that directed the victim to the device-code phishing page. The use of an HTML attachment is a calculated move; it allows the attacker to host the malicious logic locally on the victim’s machine for a brief moment, making it harder for network-level defenses to inspect the final destination of the redirect. To further insulate the phishing page from automated security scanners and "bots" used by cybersecurity firms, the attackers employed Cloudflare Turnstile. This CAPTCHA-like interface ensures that only a human user can interact with the page, effectively shielding the kit’s backend from discovery.

Stolen Tokens Allow Persistence

The most alarming aspect of the GhostCode kit is not the initial access, but what happens immediately after the token is stolen. The eSentire researchers noted that the kit is designed for rapid, automated post-authentication activity. In one recorded instance, the kit executed nine successful API calls within a mere 78-second window. This speed suggests a highly optimized backend capable of performing complex administrative tasks before a security team can even register an alert.

During this brief window, the GhostCode kit interacts with several critical Microsoft services, including Microsoft Intune Enrollment, the Device Registration Service, Azure Active Directory (now Microsoft Entra ID), and the Microsoft Graph API. The primary objective of this automation is to establish "persistence"—the ability to maintain access even if the victim changes their password or if the original session is terminated.

According to the eSentire report, the kit successfully registered three separate attacker-controlled devices within the victim’s environment in under a minute and a half. These registrations occurred at precise intervals—28, 53, and 77 seconds after the initial authentication—confirming the scripted nature of the attack. By registering these devices, the attackers create a "backdoor" that is recognized by the organization’s identity provider as a trusted, managed asset.

Perhaps most critically, the third device in the observed sequence was successfully enrolled in Microsoft Intune, the company’s cloud-based endpoint management solution. Intune enrollment is a "gold mine" for attackers because it often carries significant privileges. eSentire pointed out a harrowing detail: Intune enrollment can survive token revocation. Even if a security administrator realizes a compromise has occurred and revokes all active tokens for the victim’s account, the rogue device may remain enrolled in the tenant until it is manually identified and purged by an admin.

Furthermore, the GhostCode kit is designed to extract a Primary Refresh Token (PRT). In the hierarchy of Microsoft identity credentials, the PRT is one of the most powerful assets an attacker can possess. It is a key component of the Single Sign-On (SSO) experience on Windows devices. Obtaining a PRT via device code abuse essentially gives the threat actors SSO-equivalent access to the victim’s entire Microsoft 365 environment for the duration of the token’s life. By default, these tokens persist for 14 days, providing a massive window for data exfiltration, lateral movement, or the deployment of ransomware.

Evasion and Technical Sophistication

The developers of GhostCode have gone to great lengths to ensure their kit remains undetected by both users and security software. Beyond the use of Cloudflare Turnstile, the HTML lures are heavily padded with "junk" code and obfuscated to frustrate static analysis tools. This padding changes the file’s signature, making it difficult for antivirus programs to catch the file based on known patterns.