{"id":9534,"date":"2026-09-18T15:18:40","date_gmt":"2026-09-18T15:18:40","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=9534"},"modified":"2026-09-18T15:18:40","modified_gmt":"2026-09-18T15:18:40","slug":"ghostcode-attackers-abuse-device-codes-to-take-over-microsoft-365-accounts","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=9534","title":{"rendered":"GhostCode attackers abuse device codes to take over Microsoft 365 accounts"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

Microsoft 365 users are being tricked into handing over access to their accounts by a new phishing kit, GhostCode, that exploits a weakness in a legitimate device authorization flow. Researchers in eSentire\u2019s threat response unit identified the campaign<\/a> in late August 2026.<\/p>\n

The kit abuses Microsoft\u2019s OAuth 2.0 device authorization grant flow, a legitimate mechanism designed to enable authentication from IoT devices, smart TVs, printers, or other devices that cannot easily support a conventional browser-based login. The technique, known as device-code phishing<\/a>, has been seen in other<\/a> attacks<\/a> before. As part of the flow, the device displays a code for the user to enters in a browser on another device to complete authentication.<\/p>\n

GhostCode poses as one such device, gets Microsoft\u2019s OAuth<\/a> to generate a device code and then convinces the victim to enter it on Microsoft\u2019s authentication page. The victim then signs in and completes multifactor authentication<\/a> as normal \u2014 but the authentication is for the attacker-controlled device, allowing them to obtain the resulting authentication tokens. These tokens are then used to register attacker-controlled devices, obtain additional credentials and establish persistence in the victim\u2019s Microsoft environment.<\/p>\n

In the campaign observed by eSentire, the attack involved a social-engineering<\/a> setup where attackers pose as procurement officers through a web contact form before moving conversations to an NDA-themed HTML file. Opening the file took the victim to the device-code phishing page.<\/p>\n

<\/a>Stolen tokens allow persistence<\/h2>\n

GhostCode\u2019s post-authentication activity is focused on turning the stolen access into persistence inside the Microsoft environment. Once access was granted, eSentire recorded nine successful API calls over a 78-second period, involving Microsoft Intune Enrollment, the Device Registration Service, Azure Active Directory and Microsoft Graph.<\/p>\n

Three devices were registered during that time, at 28, 53 and 77 seconds after authentication, a sequence eSentire said was automated.<\/p>\n

The third device was also successfully enrolled into Intune, Microsoft\u2019s cloud-based device management service. eSentire noted that Intune enrollment survived token revocation: The attacker-created device remained in the tenant until it iwas explicitly removed.<\/p>\n

The attackers also obtained a Primary Refresh Token (PRT), which eSentire called \u201cone of the most powerful\u201d credentials in a Microsoft identity environment.<\/p>\n

\u201cObtaining a PRT via device code abuse gives the threat actors essentially SSO-equivalent access to the victim\u2019s entire M365 environment for the PRT\u2019s lifetime \u2014 including any service not explicitly protected by a Conditional Access policy requiring a compliant device,\u201d eSentire said, adding that the token persists 14 days by default.<\/p>\n

The attackers also employed multiple evasion techniques, including padding and obfuscating the HTML code in their lure, encrypting redirects, checking for bots, and using Cloudflare Turnstile<\/a> to keep security tools away from the phishing page.<\/p>\n

<\/a>What defenders can do<\/h2>\n

To defend against attacks like this, eSentire\u2019s researchers recommend restricting Microsoft\u2019s device-code authentication flow through Conditional Access <\/a>and disabling it for users who do not need it. It also<\/p>\n

They also advise monitoring the Device Registration Service for multiple device registrations from a single non-interactive session, and looking for activity involving the user agent python-requests following device-code authentication.<\/p>\n

Auditing Entra ID for devices matching GhostCode\u2019s naming pattern and correlating successful device-code authentication with subsequent Python-based requests, should be able to catch an attack in progress, the company said. It shared a list of indicators of comprise related to the campaign to aid detection.<\/p>\n

GhostCode adds to a growing number of attacks abusing device-code phishing to target Microsoft\u2019s OAuth authentication flow<\/a>. Recent examples include attacks using the \u201cEvilTokens\u201d<\/a> phishing-as-a-service (PhaaS) kit, a campaign reported<\/a> by KnowBe4 in February 2026, and activity observed<\/a> in December 2026 involving multiple clusters, including both financially motivated and state-sponsored actors.<\/p>\n

This article first appeared on <\/em>Computerworld<\/a>.<\/em><\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

Microsoft 365 users are being tricked into handing over access to their accounts by a new phishing kit, GhostCode, that exploits a weakness in a legitimate device authorization flow. Researchers in eSentire\u2019s threat response unit identified the campaign in late August 2026. The kit abuses Microsoft\u2019s OAuth 2.0 device authorization grant flow, a legitimate mechanism […]<\/p>\n","protected":false},"author":0,"featured_media":9535,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-9534","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9534"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=9534"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9534\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/9535"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=9534"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=9534"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=9534"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}