In an era where perimeter defenses are increasingly robust, cybercriminals are shifting their focus toward the "human element" and the subtle, legitimate workflows that bridge the gap between user identities and cloud services. The latest threat to emerge from this tactical shift is "GhostCode," a sophisticated phishing kit that weaponizes Microsoft’s own OAuth 2.0 device authorization flow to hijack enterprise accounts and establish long-term, persistent access to sensitive Microsoft 365 (M365) environments.
Identified by the threat response unit at eSentire in late August 2026, GhostCode represents a maturation of "device-code phishing," a technique that exploits a mechanism originally designed for convenience. By tricking users into authorizing an attacker-controlled device as their own, malicious actors can bypass traditional MFA hurdles, turning a standard authentication request into a total compromise of the victim’s digital identity.
The Anatomy of the Attack: How GhostCode Works
The fundamental weakness being exploited lies in the OAuth 2.0 device authorization grant flow. This flow was created to allow devices with limited input capabilities—such as smart TVs, printers, or IoT appliances—to authenticate with cloud services. The process is inherently user-centric: a device displays a short alphanumeric code, and the user must navigate to a Microsoft URL on a separate, browser-equipped machine to enter that code and sign in.
GhostCode weaponizes this process through a multi-stage social engineering campaign. Researchers found that attackers typically initiate contact by posing as procurement officers or external partners. Through web contact forms, they establish a rapport before redirecting the target to an NDA-themed HTML file.
Once the victim opens this file, the trap is sprung. The phishing kit interacts with the Microsoft identity platform to generate a legitimate device code. It then presents this code to the victim under the guise of an authentication requirement, prompting the user to enter it into a seemingly authentic Microsoft login portal.
Crucially, when the victim enters their credentials and completes multifactor authentication (MFA), they are not authenticating their own hardware; they are providing the final "blessing" for the attacker’s device. Because the authentication is technically legitimate, the platform grants the attacker-controlled device the necessary authentication tokens, effectively handing the keys to the kingdom to the threat actor.
Chronology of an Identity Hijack
The efficiency of the GhostCode kit is best illustrated by the automated speed at which it operates once the victim has authenticated. eSentire’s forensic analysis of the August campaign revealed a highly orchestrated sequence of events that occurs within seconds of the initial authorization.
The 78-Second Infiltration
- 0-20 seconds: The victim authenticates the device via the phishing portal.
- 28 seconds: The first attacker-controlled device is registered to the victim’s tenant.
- 53 seconds: A second device is registered, effectively creating redundancy for the attacker.
- 77 seconds: A third device is registered and immediately enrolled into Microsoft Intune, the company’s cloud-based mobile device management (MDM) solution.
This rapid-fire series of API calls—spanning Microsoft Intune Enrollment, the Device Registration Service, Azure Active Directory (Entra ID), and Microsoft Graph—is entirely automated. By the time the user has closed their browser tab, their environment has already been compromised by three distinct, persistent "rogue" devices.
Supporting Data: Persistence and the Power of the PRT
The primary objective of GhostCode is not just initial entry, but long-term persistence. The most alarming aspect of the campaign is the acquisition of a Primary Refresh Token (PRT).
In the Microsoft ecosystem, a PRT is a critical artifact used to facilitate Single Sign-On (SSO) across various services. It serves as a "golden ticket" that proves a device is trusted and a user is authenticated. By obtaining a PRT, the GhostCode attackers gain access that is equivalent to the victim’s own SSO session.
According to eSentire, this access persists for the lifetime of the PRT—which defaults to 14 days—allowing attackers to access any service not explicitly protected by strict Conditional Access policies. Even more concerning is the Intune enrollment. Because this enrollment is registered as a "legitimate" device management action, it often survives standard password resets or token revocations. The malicious device remains an "enrolled" entity within the tenant until an administrator manually intervenes to purge it.
Evasion and Sophistication
GhostCode does not rely on brute force; it relies on deception. The developers behind the kit have implemented a layered defense-evasion strategy to ensure the phishing page remains active and undetected by security vendors:
- Code Obfuscation: The HTML lures are heavily padded and obfuscated to prevent signature-based detection by web filters.
- Redirect Encryption: Attackers use encrypted redirects to hide the final destination of the phishing link, thwarting automated link-analysis tools.
- Bot Detection: The kit utilizes advanced scripts to detect if the incoming traffic is from a security researcher or a automated crawler.
- Cloudflare Turnstile: By leveraging services like Cloudflare Turnstile, the attackers provide a "human" verification challenge that legitimate users pass, while effectively blocking many automated security scanners that might otherwise flag the malicious site.
Implications for Enterprise Security
The rise of GhostCode highlights a systemic tension between user convenience and security. The OAuth device flow is a "quality-of-life" feature for modern workplaces, but it has become a primary target for threat actors who understand that users are generally conditioned to trust Microsoft-branded login pages.
The implications for enterprises are significant. When an attacker gains the ability to register devices, they effectively bypass traditional "something you have" MFA protections. Because the device is now "enrolled" and "trusted" by the internal Intune policies, the attacker can move laterally through the network, access internal SharePoint sites, read corporate emails, and potentially exfiltrate sensitive data—all while appearing to be a standard, compliant employee device.
This trend is not isolated. GhostCode joins a growing list of "Phishing-as-a-Service" (PhaaS) platforms, such as the "EvilTokens" kit and various state-sponsored campaigns identified in late 2026. As these kits become more accessible on the dark web, the barrier to entry for high-level enterprise infiltration continues to drop.
Official Recommendations and Defensive Strategies
To defend against GhostCode and similar device-code phishing attacks, security teams must move beyond legacy identity management. eSentire and cybersecurity experts suggest the following multi-pronged approach:
1. Restrict Device Code Flows
The most effective defense is to restrict the use of device-code authentication. Organizations should leverage Conditional Access policies to disable device-code flows for any user or group that does not explicitly require them for hardware integration. If a user does not need to pair a smart TV or a printer with their account, they should not have the ability to initiate a device-code login.
2. Monitor for Anomalous Registration
Security operations centers (SOCs) should set up specific alerts in Microsoft Entra ID for:
- Bulk Device Registration: Monitor for multiple device registrations occurring within a short window from a single, non-interactive session.
- User Agent Anomalies: Flag activity involving the
python-requestsuser agent following a successful device-code authentication. Attackers frequently use Python-based scripts to automate the registration process after the initial token theft. - Naming Patterns: Periodically audit Entra ID for devices that follow suspicious naming conventions that differ from the organization’s standard device-naming policy.
3. Strengthen Identity Governance
Ensure that all service-level access is protected by Conditional Access policies that require "Compliant Devices." By forcing users to interact with services only through managed, compliant hardware, you mitigate the risk of a "rogue" device—even one with a valid PRT—being used to access sensitive cloud resources.
4. User Awareness
Finally, organizations must update their security training to specifically address device-code phishing. Users should be educated that they should never enter a code into a browser unless they have personally initiated a connection with a hardware device (like a new printer or a smart conference room display). If a user receives a prompt to enter a code while working on an NDA, a spreadsheet, or an email, it is almost certainly a malicious attempt to hijack their identity.
As we look toward the future, the GhostCode incident serves as a stark reminder: the most effective attacks are those that leverage the system’s own trust mechanisms against it. In the cat-and-mouse game of cybersecurity, the responsibility falls on administrators to close the gap between legitimate convenience and potential catastrophe.
