GhostCode: The Emerging Phishing Threat Exploiting Microsoft 365 Device Authorization Flows

The redirects used within the phishing flow are also encrypted, ensuring that the final URL of the phishing landing page is not easily visible to network monitoring tools. This layer of encryption prevents security gateways from inspecting the traffic and identifying the malicious domain. These techniques, combined with the use of legitimate Microsoft infrastructure for the actual login process, create a "low and slow" profile that can easily slip past traditional perimeter defenses.

What Defenders Can Do

As phishing kits like GhostCode become more prevalent, the burden falls on IT and security departments to move beyond simple MFA and adopt more granular access controls. The researchers at eSentire have provided a roadmap for defending against this specific brand of device-code abuse.

The most effective defense is the implementation of Conditional Access (CA) policies within Microsoft Entra ID. Administrators should strictly limit the use of the device-code authentication flow. For the vast majority of corporate users, this flow is unnecessary, as they use standard browsers on managed laptops or mobile devices. By disabling the device-code flow for all but a specific group of users who require it for legacy hardware, organizations can eliminate the primary attack surface used by GhostCode.

Furthermore, security teams should implement rigorous monitoring of the Device Registration Service. Alerts should be configured to trigger whenever multiple devices are registered to a single user account within a short timeframe, particularly if those registrations occur during a non-interactive session. The use of specific User Agents can also be a tell-tale sign of automation; eSentire recommends looking for activity involving the "python-requests" library immediately following a successful device-code authentication, as this often indicates the kit’s automated script is at work.

Auditing is another critical component of the defense strategy. Administrators should regularly review their Entra ID logs for devices that match the naming patterns or characteristics associated with GhostCode. Correlating these registrations with the timing of device-code logins can help identify a breach in progress. eSentire has shared a list of indicators of compromise (IoCs) to assist the community in these detection efforts.

A Growing Trend in OAuth Abuse

GhostCode is not an isolated phenomenon but rather part of a broader surge in attacks targeting the Microsoft OAuth authentication flow. It joins other notorious tools such as the "EvilTokens" phishing-as-a-service (PhaaS) kit, which has been used extensively for account takeovers. Similar campaigns were reported by KnowBe4 in early 2026, and Microsoft’s own threat intelligence teams have tracked clusters of activity—such as those attributed to Storm-2372—that utilize nearly identical tactics.

These attacks are being carried out by a diverse range of actors, from financially motivated cybercriminals looking to sell access on the dark web to state-sponsored groups seeking to conduct long-term espionage. The common thread among them is the realization that in a cloud-first world, identity is the new perimeter. By mastering the abuse of legitimate authentication flows, tools like GhostCode have ensured that the battle for corporate security will be fought not at the firewall, but in the nuances of token management and session authorization.