GhostCode Phishing Kit Hijacks Microsoft Device Codes to Breach Firms

Researchers at eSentire’s Threat Response Unit (TRU) have identified a phishing kit dubbed GhostCode that abuses Microsoft’s OAuth 2.0 device authorisation flow to target enterprise sales teams and service providers in North America. The unidentified, financially motivated cybercrime cluster reportedly approaches employees through legitimate corporate contact forms, posing as procurement executives.

After establishing contact, the attackers send a password-protected HTML attachment disguised as a file-transfer link or FlipBook document portal, often alongside a purported non-disclosure agreement.

The attachment uses thousands of junk characters, comments inserted between visible characters and AES-256-GCM encryption to hinder scanning and conceal its redirect address. Following an anti-bot check, victims are shown a fraudulent portal that obtains a Microsoft device code and directs them to the genuine Microsoft sign-in page. If the victim enters the code and completes multi-factor authentication, the attackers capture the resulting session tokens.

In one incident analysed by TRU, three rogue devices were registered within 78 seconds and a Primary Refresh Token was obtained 32 seconds after login. The token reportedly enabled access across the Microsoft 365 tenant, including bypassing device compliance controls and enrolling devices in management systems.

More than 30 lookalike domains were registered in August 2026, impersonating distributors, food suppliers and warehousing companies. TRU attributes the activity to an unidentified cluster with moderate confidence. The researchers recommend restricting device-code authentication, applying Conditional Access policies requiring compliant corporate devices, monitoring for rapid or sequential device registrations, and training customer-facing staff to verify unexpected business approaches and external links.