GhostCode attackers abuse device codes to take over Microsoft 365 accounts
A new phishing kit called GhostCode is bypassing MFA to steal Microsoft 365 accounts — and the stolen credentials survive token revocation. Here's what defenders need to monitor.
Why it matters
GhostCode exploits Microsoft's device-code OAuth flow to gain SSO-equivalent access to entire M365 environments. This is not a theoretical vulnerability — eSentire observed active campaigns establishing persistence through automated device enrollment and Primary Refresh Tokens that last 14 days by default. Practitioners managing Microsoft 365 deployments need detection rules and Conditional Access policies in place now.
The key facts
18 to knowGhostCode phishing kit abuses Microsoft OAuth 2.0 device authorization grant flow
Attackers obtained Primary Refresh Token (PRT) — 'one of the most powerful' credentials in M365 identity environment
PRT persists 14 days by default and survives token revocation
Nine API calls recorded over 78-second period post-authentication; three devices registered in automated sequence
Intune enrollment survived token revocation until explicitly removed
Attacker-controlled device achieved SSO-equivalent access to entire M365 environment
Campaign involved social engineering via procurement officer impersonation and NDA-themed HTML files
Defense recommendations: restrict device-code auth via Conditional Access, monitor Device Registration Service for multiple registrations from single non-interactive session, audit for python-requests user agent post-authentication
Part of growing trend: prior device-code attacks include 'EvilTokens' PhaaS kit (Feb 2026) and multi-cluster state-sponsored activity (Dec 2026)
GhostCode abuses Microsoft OAuth 2.0 device authorization flow to trick users into authorizing attacker devices
Stolen Primary Refresh Token (PRT) grants SSO-equivalent access to entire M365 environment for 14 days by default
Intune enrollment survives token revocation, providing persistence even after credential rotation
Attackers registered 3 devices in 78 seconds post-authentication using automated API calls
Campaign used social engineering (posing as procurement officers) + NDA-themed HTML lure to deliver phishing page
Evasion techniques included HTML obfuscation, encrypted redirects, bot detection, Cloudflare Turnstile
Defense recommendations: restrict device-code auth via Conditional Access, monitor Device Registration Service for bulk registrations, audit for python-requests user agent post-authentication
Related campaigns: EvilTokens PhaaS kit (Feb 2026), December 2026 multi-cluster activity (financially motivated + state-sponsored actors)
Identified by eSentire threat response unit in late August 2026
Go to the source
Computerworldcomputerworld.com
Publisher excerpt: Microsoft 365 users are being tricked into handing over access to their accounts by a new phishing kit, GhostCode, that exploits a weakness in a legitimate device authorization flow. Researchers in eSentire’s threat response unit identified the campaign in late August 2026. The kit abuses…