In the ever-evolving landscape of cybersecurity, threat actors are increasingly abandoning brute-force tactics in favor of exploiting the very features designed to improve user convenience. A newly identified phishing kit, dubbed "GhostCode," has emerged as a sophisticated example of this shift, specifically targeting the OAuth 2.0 device authorization flow within Microsoft 365 environments. By masquerading as a legitimate device pairing process, GhostCode bypasses traditional security perimeters, allowing attackers to hijack accounts, register rogue devices, and maintain persistent access to sensitive corporate data.
The Mechanics of the Breach: How GhostCode Operates
At its core, GhostCode is a masterclass in social engineering and protocol abuse. Identified by researchers at eSentire’s Threat Response Unit in late August 2026, the kit leverages a legitimate Microsoft mechanism: the OAuth 2.0 device authorization grant flow. This flow was originally designed to facilitate authentication for "input-constrained" devices—such as printers, smart TVs, and IoT hardware—that lack the interface for a standard web-browser login.
The process is deceptively simple: a user is presented with a unique alphanumeric code and instructed to visit a URL (typically microsoft.com/devicelogin) to enter it. When the user completes this on their primary, authenticated device, the "input-constrained" device is granted access tokens. GhostCode weaponizes this trust.
The Social Engineering Lure
The campaign begins with a classic procurement-based social engineering scheme. Attackers reach out to employees via web contact forms, posing as legitimate procurement officers. The correspondence is professional and urgent, eventually moving the victim to an NDA-themed HTML file. Upon opening this file, the victim is seamlessly redirected to a phishing page that initiates the device-code flow.
Unlike older, cruder phishing attempts, GhostCode is highly polished. It utilizes obfuscated HTML, encrypted redirects, and Cloudflare Turnstile—a bot-detection service—to filter out automated security scanners and ensure only the intended human victim reaches the malicious portal.
Chronology of an Attack: A 78-Second Takeover
The efficiency of GhostCode is perhaps its most alarming attribute. Once a victim enters the provided device code and completes their multifactor authentication (MFA) on their own device, the "authentication" is effectively redirected to the attacker.
eSentire’s analysis of the campaign revealed a rapid-fire sequence of events occurring over a mere 78 seconds:
- T+0 Seconds: The victim completes the MFA prompt, unknowingly granting the attacker’s rogue device access to their Microsoft 365 environment.
- T+28 Seconds: The attacker-controlled system automatically registers the first rogue device within the victim’s tenant.
- T+53 Seconds: A second device is registered, bypassing standard administrative hurdles.
- T+77 Seconds: A third device is registered and, crucially, enrolled into Microsoft Intune—the organization’s cloud-based device management service.
This automation highlights the shift from manual account hijacking to "phishing-as-a-service" (PhaaS) models, where the attacker’s post-exploitation activity is scripted to maximize impact before the victim even realizes their credentials have been compromised.
The Significance of Persistent Access
The primary objective of GhostCode is not just temporary access; it is long-term persistence. By enrolling a rogue device into Intune, the attackers ensure that their access survives even if the victim changes their password or revokes the initial OAuth token. Because the device is now "managed" by the tenant’s own Intune policy, it remains in the environment until an administrator manually intervenes and purges the device identity.
Furthermore, the attackers secure a Primary Refresh Token (PRT). In the Microsoft identity ecosystem, the PRT is arguably the "holy grail" of credentials. It provides Single Sign-On (SSO) equivalent access to the entire M365 suite. According to eSentire, this token persists for 14 days by default, during which time the attacker can access any service not strictly gated by a Conditional Access policy that mandates a "compliant" device. Even then, by successfully enrolling a rogue device in Intune, the attacker may be able to trick the environment into viewing the malicious device as "compliant," effectively neutralizing that defense.
Supporting Data and The "PhaaS" Ecosystem
GhostCode is not an isolated incident; it represents a growing trend in the threat landscape. The proliferation of Phishing-as-a-Service (PhaaS) kits has lowered the barrier to entry for cybercriminals, allowing even low-skilled actors to deploy sophisticated, multi-stage attacks.
Data from the past two years shows a clear trajectory:
- February 2026: Reports surfaced regarding "EvilTokens," a PhaaS kit that similarly abused the Microsoft device-code flow to capture tokens and bypass MFA.
- December 2026: A wave of attacks involving multiple clusters of threat actors—ranging from financially motivated gangs to state-sponsored entities—demonstrated that the technique had become a preferred method for hijacking enterprise accounts.
- Current Status: GhostCode represents the next generation of these tools, featuring superior evasion techniques and automated post-exploitation workflows that make detection significantly harder for standard security operations centers (SOCs).
Implications for Enterprise Security
The rise of GhostCode poses a direct challenge to the "Zero Trust" model. Organizations have spent years implementing MFA to protect against credential theft, yet GhostCode demonstrates that MFA is not a panacea when the underlying protocol—the OAuth device flow—is manipulated to grant access after the MFA challenge is satisfied.
The implication is clear: the threat is moving from the identity layer to the device management layer. When an attacker can register an arbitrary device and enroll it in management services like Intune, the perimeter is essentially dissolved. Organizations that rely heavily on M365 are now forced to treat every device enrollment event as a potential security incident.
Strategic Recommendations for Defenders
eSentire’s research team has provided a roadmap for organizations to harden their environments against this class of attack. While the threat is significant, it is not unstoppable.
1. Restrict Device Code Flow
The most effective defense is the principle of least privilege. Organizations should use Conditional Access policies to restrict the use of the device-code flow to only those users and scenarios where it is strictly necessary. If a user does not require the ability to pair IoT devices, the capability should be disabled for their account.
2. Monitor and Audit
Security teams must enhance their monitoring of the Device Registration Service. Specifically:
- Look for non-interactive sessions: High-velocity registrations (multiple devices in under two minutes) from a single session are a massive red flag.
- Python-requests identification: Monitor for authentication requests originating from the
python-requestsuser agent. Legitimate browser-based authentication rarely utilizes this library. - Naming Conventions: Audit Entra ID for devices that match the naming patterns used by known phishing kits.
3. Conditional Access and Compliance
Organizations should move beyond simple MFA. Implementing strict Conditional Access policies that require devices to be marked as "compliant" or "hybrid joined" before accessing sensitive resources can mitigate the impact of a stolen PRT. While GhostCode can attempt to enroll rogue devices, a robust device health attestation process can prevent these unauthorized devices from accessing high-value data.
4. Employee Awareness
Despite the technical sophistication of the attack, the initial delivery remains social engineering. Employees should be trained to recognize the signs of procurement fraud and to be wary of any request to navigate to a site that asks for a device code—especially if it is linked from an unexpected or unsolicited NDA-related file.
Conclusion
GhostCode serves as a sobering reminder that innovation in cybersecurity is a double-edged sword. As platforms like Microsoft 365 become more interconnected and feature-rich, the attack surface expands into the protocols that make those integrations possible.
By abusing the trust placed in the OAuth 2.0 device authorization flow, attackers have found a way to turn the victim’s own security infrastructure against them. Defending against this requires more than just standard MFA; it demands a granular understanding of how devices are authenticated, managed, and registered within the enterprise. As we look toward the remainder of 2026 and beyond, the ability to correlate identity authentication with device management behavior will be the deciding factor in whether an organization remains secure or falls victim to the next iteration of the GhostCode threat.
