GhostCode Phishing Kit Turns Microsoft's Own Login Flow Against You

Key points

• GhostCode, identified by eSentire's threat response unit in late August 2026, is a phishing kit that abuses Microsoft's OAuth 2.0 device authorization flow to steal account tokens from Microsoft 365 users.
• After a victim authenticated, attackers registered three separate devices inside the victim's Microsoft environment within 77 seconds, in a sequence eSentire assessed as fully automated.
• One registered device was enrolled into Microsoft Intune and survived token revocation, persisting in the victim's environment even after stolen passwords were reset.
• Attackers also obtained a Primary Refresh Token, a high-value credential that gives sign-in access across the entire Microsoft 365 environment for up to 14 days by default.
• Microsoft has since linked the broader device-code phishing technique to Midnight Blizzard, a Russian state-sponsored hacking group, after initially tracking related activity under the name Storm-2372.

What actually happened here?

Attackers used GhostCode to impersonate a device that cannot handle a normal browser login, trick Microsoft into issuing a short code, then convince a real person to type that code into Microsoft's own website. The victim does everything right, including completing multi-factor authentication, the extra verification step where a user confirms their identity through a phone or app. But the sign-in authorises the attacker's device, not the victim's.

The social engineering setup was deliberate. Attackers first posed as procurement officers through a standard web contact form, then steered the conversation toward an NDA-themed HTML file. Opening that file sent the victim to the device-code phishing page. It's a longer con than most phishing attacks, and it's one reason the payload worked.

Once a victim authenticated, eSentire recorded nine successful API calls in 78 seconds. Three separate devices were registered at the 28-second, 53-second, and 77-second marks. The third was also enrolled in Microsoft Intune, Microsoft's cloud service for managing company devices remotely.

Why does Intune enrollment matter so much?

Because it survived token revocation. Revoking a token is the standard first response when an account is taken over: you invalidate the stolen credentials and force a fresh login. GhostCode's Intune-enrolled device stayed in the victim's Microsoft tenant until someone explicitly removed it by hand.

Beyond persistence, eSentire flagged that attackers obtained a Primary Refresh Token. It acts as a master key, granting silent sign-in access across the whole Microsoft 365 environment for every app not explicitly locked down by a company security policy. That token lasts 14 days by default.

"Obtaining a PRT via device code abuse gives the threat actors essentially SSO-equivalent access to the victim's entire M365 environment for the PRT's lifetime," eSentire said, where SSO (single sign-on) means one credential unlocks many services at once.

GhostCode also used several tricks to stay hidden: the HTML lure was padded and obfuscated (deliberately scrambled to confuse scanning tools), redirects were encrypted, bot-detection checks kept automated security crawlers off the phishing page, and Cloudflare Turnstile added another layer of gating.

Is this a new kind of attack?

Not exactly. Device-code phishing has been a documented technique for years. We've now covered it eight times since first reporting the method in June, and the pace hasn't slowed. Microsoft's own February 2025 advisory attributed a large wave of it to Storm-2372, a cluster Microsoft later rolled into Midnight Blizzard, the Russian intelligence-linked group responsible for the SolarWinds supply-chain attack. A separate Microsoft Defender advisory from March 2026 also documented attackers abusing OAuth's built-in redirection features to bypass standard phishing filters, a close relative of what GhostCode does.

GhostCode is the latest commercial packaging of that technique, alongside kits like EvilTokens. The attack class is to credential phishing what SQL injection is to web attacks: a well-understood flaw in a by-design feature that keeps getting reused because organisations haven't closed the gap. The honest read here is that GhostCode isn't clever so much as relentless, and the Intune persistence trick is the detail defenders should actually lose sleep over.

ESentire recommends that companies restrict the device-code authentication flow through Microsoft Conditional Access policies, the rules that govern who can sign in under what conditions, and disable it entirely for users who have no need for it. Monitoring the Device Registration Service for multiple registrations from a single non-interactive session, and watching for web traffic from the Python requests library immediately after device-code authentication, are both practical detection signals.

Common questions

Does resetting my Microsoft password protect me?

Not on its own. If GhostCode already enrolled a device in Intune, that device remains in your company's system even after a password change. An IT administrator needs to manually find and remove any devices registered during the attack window.

What can ordinary employees do to avoid this?

Be sceptical of any unsolicited document that asks you to visit a website and type a code into a Microsoft login page. Legitimate IT processes rarely arrive through personal contact forms or NDA attachments from unknown senders. If something feels off, call your IT team before clicking.