GhostCode: The Emerging Phishing Threat Exploiting Microsoft 365 Device Authorization Flows

In a significant escalation of identity-based cyberattacks, security researchers have uncovered a sophisticated new phishing kit dubbed "GhostCode." This tool is specifically designed to subvert legitimate Microsoft 365 authentication processes, allowing threat actors to bypass multi-factor authentication (MFA), hijack user sessions, and establish a long-term, persistent presence within corporate cloud environments. The discovery, made by eSentire’s Threat Response Unit (TRU) in late August 2026, highlights a growing trend where attackers no longer seek to steal passwords, but rather the digital tokens that grant access to modern enterprise applications.

The GhostCode campaign represents a refined evolution of "device-code phishing," a technique that exploits the OAuth 2.0 device authorization grant flow. While this flow was originally engineered by Microsoft to facilitate ease of use for devices with limited input capabilities, it has increasingly become a blind spot for security teams and a lucrative target for cybercriminals. By manipulating this legitimate mechanism, GhostCode allows attackers to enroll their own rogue devices into a victim’s tenant, effectively turning a single successful phishing lure into a full-scale organizational compromise.

The Mechanics of the Device Code Abuse

To understand the threat posed by GhostCode, one must first understand the legitimate technology it subverts. The OAuth 2.0 device authorization grant flow is a standard protocol designed for "input-constrained" devices. These include smart TVs, printers, IoT hardware, and various terminal-based applications that lack a full web browser or a keyboard suitable for complex password entry. In a standard scenario, such a device displays a short, alphanumeric code and directs the user to a Microsoft URL (such as microsoft.com/devicelogin) on a separate device, like a smartphone or laptop. Once the user enters the code and authenticates on their browser, the original device is granted an access token.

GhostCode weaponizes this convenience. Instead of a smart TV requesting access, the phishing kit poses as a legitimate Microsoft-affiliated application or service. The attacker initiates the flow, receives a code from Microsoft, and then delivers that code to the victim via a social engineering lure. When the victim enters the code into the official Microsoft portal, they believe they are performing a routine authorization. In reality, they are authorizing the attacker’s infrastructure to act on their behalf.

Because the victim is logging into the official Microsoft website, they encounter all the standard security prompts, including multi-factor authentication (MFA). To the user, the process looks entirely legitimate. However, once the MFA challenge is completed, the resulting authentication tokens are not sent to the user’s device; they are intercepted by the GhostCode kit. This "adversary-in-the-middle" approach renders traditional MFA protections insufficient, as the user themselves provides the necessary second factor directly to the legitimate service provider, unknowingly validating the attacker’s session.

Social Engineering and the Initial Infection Vector

The success of GhostCode relies heavily on a highly targeted social engineering strategy. In the campaigns observed by eSentire, the threat actors did not rely on broad, poorly drafted spam emails. Instead, they adopted the persona of procurement officers or business representatives. The initial contact often occurred through a legitimate web contact form on a target company’s website—a tactic designed to bypass traditional email security filters that might flag unsolicited external messages.

The attackers would initiate a conversation regarding a potential business deal or a procurement inquiry. Once they established a rapport with a target employee, the conversation would be moved to the exchange of sensitive documents. The "hook" in the GhostCode campaign was an NDA-themed HTML file. Victims were told they needed to review and sign the non-disclosure agreement before proceeding with the business transaction.

When the victim opened the HTML file, they were not presented with a document. Instead, the file contained obfuscated code that directed the victim to the device-code phishing page. The use of an HTML attachment is a calculated move; it allows the attacker to host the malicious logic locally on the victim’s machine for a brief moment, making it harder for network-level defenses to inspect the final destination of the redirect. To further insulate the phishing page from automated security scanners and "bots" used by cybersecurity firms, the attackers employed Cloudflare Turnstile. This CAPTCHA-like interface ensures that only a human user can interact with the page, effectively shielding the kit’s backend from discovery.

Stolen Tokens Allow Persistence

The most alarming aspect of the GhostCode kit is not the initial access, but what happens immediately after the token is stolen. The eSentire researchers noted that the kit is designed for rapid, automated post-authentication activity. In one recorded instance, the kit executed nine successful API calls within a mere 78-second window. This speed suggests a highly optimized backend capable of performing complex administrative tasks before a security team can even register an alert.

During this brief window, the GhostCode kit interacts with several critical Microsoft services, including Microsoft Intune Enrollment, the Device Registration Service, Azure Active Directory (now Microsoft Entra ID), and the Microsoft Graph API. The primary objective of this automation is to establish "persistence"—the ability to maintain access even if the victim changes their password or if the original session is terminated.

According to the eSentire report, the kit successfully registered three separate attacker-controlled devices within the victim’s environment in under a minute and a half. These registrations occurred at precise intervals—28, 53, and 77 seconds after the initial authentication—confirming the scripted nature of the attack. By registering these devices, the attackers create a "backdoor" that is recognized by the organization’s identity provider as a trusted, managed asset.

Perhaps most critically, the third device in the observed sequence was successfully enrolled in Microsoft Intune, the company’s cloud-based endpoint management solution. Intune enrollment is a "gold mine" for attackers because it often carries significant privileges. eSentire pointed out a harrowing detail: Intune enrollment can survive token revocation. Even if a security administrator realizes a compromise has occurred and revokes all active tokens for the victim’s account, the rogue device may remain enrolled in the tenant until it is manually identified and purged by an admin.

Furthermore, the GhostCode kit is designed to extract a Primary Refresh Token (PRT). In the hierarchy of Microsoft identity credentials, the PRT is one of the most powerful assets an attacker can possess. It is a key component of the Single Sign-On (SSO) experience on Windows devices. Obtaining a PRT via device code abuse essentially gives the threat actors SSO-equivalent access to the victim’s entire Microsoft 365 environment for the duration of the token’s life. By default, these tokens persist for 14 days, providing a massive window for data exfiltration, lateral movement, or the deployment of ransomware.

Evasion and Technical Sophistication

The developers of GhostCode have gone to great lengths to ensure their kit remains undetected by both users and security software. Beyond the use of Cloudflare Turnstile, the HTML lures are heavily padded with "junk" code and obfuscated to frustrate static analysis tools. This padding changes the file’s signature, making it difficult for antivirus programs to catch the file based on known patterns.

The redirects used within the phishing flow are also encrypted, ensuring that the final URL of the phishing landing page is not easily visible to network monitoring tools. This layer of encryption prevents security gateways from inspecting the traffic and identifying the malicious domain. These techniques, combined with the use of legitimate Microsoft infrastructure for the actual login process, create a "low and slow" profile that can easily slip past traditional perimeter defenses.

What Defenders Can Do

As phishing kits like GhostCode become more prevalent, the burden falls on IT and security departments to move beyond simple MFA and adopt more granular access controls. The researchers at eSentire have provided a roadmap for defending against this specific brand of device-code abuse.

The most effective defense is the implementation of Conditional Access (CA) policies within Microsoft Entra ID. Administrators should strictly limit the use of the device-code authentication flow. For the vast majority of corporate users, this flow is unnecessary, as they use standard browsers on managed laptops or mobile devices. By disabling the device-code flow for all but a specific group of users who require it for legacy hardware, organizations can eliminate the primary attack surface used by GhostCode.

Furthermore, security teams should implement rigorous monitoring of the Device Registration Service. Alerts should be configured to trigger whenever multiple devices are registered to a single user account within a short timeframe, particularly if those registrations occur during a non-interactive session. The use of specific User Agents can also be a tell-tale sign of automation; eSentire recommends looking for activity involving the "python-requests" library immediately following a successful device-code authentication, as this often indicates the kit’s automated script is at work.

Auditing is another critical component of the defense strategy. Administrators should regularly review their Entra ID logs for devices that match the naming patterns or characteristics associated with GhostCode. Correlating these registrations with the timing of device-code logins can help identify a breach in progress. eSentire has shared a list of indicators of compromise (IoCs) to assist the community in these detection efforts.

A Growing Trend in OAuth Abuse

GhostCode is not an isolated phenomenon but rather part of a broader surge in attacks targeting the Microsoft OAuth authentication flow. It joins other notorious tools such as the "EvilTokens" phishing-as-a-service (PhaaS) kit, which has been used extensively for account takeovers. Similar campaigns were reported by KnowBe4 in early 2026, and Microsoft’s own threat intelligence teams have tracked clusters of activity—such as those attributed to Storm-2372—that utilize nearly identical tactics.

These attacks are being carried out by a diverse range of actors, from financially motivated cybercriminals looking to sell access on the dark web to state-sponsored groups seeking to conduct long-term espionage. The common thread among them is the realization that in a cloud-first world, identity is the new perimeter. By mastering the abuse of legitimate authentication flows, tools like GhostCode have ensured that the battle for corporate security will be fought not at the firewall, but in the nuances of token management and session authorization.