Phishing Threat: GhostCode Exploits Device Authorization in Microsoft 365

Microsoft 365 users are currently facing a sophisticated phishing threat from a new toolkit named GhostCode, which cleverly exploits a flaw in the legitimate device authorization process. Identified by eSentire’s threat response team in late August 2026, this phishing scheme raises serious concerns over account security. As organizations increasingly adopt cloud-based solutions like Microsoft 365, the security implications of such threats become significantly more pressing.

Understanding the GhostCode Threat

At the heart of GhostCode's operation is a manipulation of Microsoft's OAuth 2.0 device authorization grant flow. This process is typically used for devices lacking traditional login capabilities, such as smart TVs, IoT devices, and printers. The method, often referred to as device-code phishing, has emerged in various past attacks. This method offers attackers a unique vector to bypass standard security protocols by taking advantage of trust relationships established by device authorization processes.

GhostCode masquerades as one of these legitimate devices by obtaining a device code from Microsoft’s OAuth service and tricking users into entering this code on a phishing site. Users are often unaware they're interacting with a fraudulent entity. The approach leads victims to inadvertently complete the multifactor authentication process, which is actually directed towards the attackers' infrastructure. Once the attackers have the authentication tokens generated through this deception, the possibilities widen considerably. They can register their malicious devices, harvest additional credentials, and create a persistent foothold within the targeted Microsoft environment.

Persistent Access via Stolen Tokens

Once attackers gain access, they focus on securing a long-term presence within the victim’s Microsoft ecosystem. The aftermath of this phishing scheme showcases the alarming speed and effectiveness of their actions. eSentire recorded a series of successful API calls shortly after the initial authentication—within just 78 seconds. They registered three devices with Microsoft services like Intune and Azure Active Directory, highlighting how quickly attackers can capitalize on stolen credentials.

These devices were not merely temporary exploits; for instance, the third device successfully enrolled in Microsoft’s Intune management service, effectively retaining its presence even when the attackers' tokens were revoked. This highlights a critical vulnerability within the Microsoft infrastructure—attackers managed to secure a Primary Refresh Token (PRT), which experts regard as a vital credential in Microsoft environments. This PRT grants near-constant access to the victim's entire Microsoft 365 setup, bypassing conditional access safeguards that should ideally limit service access. When such persistent threats are embedded, the potential for long-term data breaches skyrockets.

Evading Detection: A Study in Tactics

To enhance their evasion tactics, GhostCode employs various strategies, such as obfuscating the lure’s HTML code and encrypting redirects. These methods complicate detection efforts significantly. Attackers understand the importance of not raising red flags, and it's absolutely evident in the tools they use. By implementing solutions like Cloudflare Turnstile, they manage to avoid triggering many established security measures. Ignoring the sophistication of these attacks can lead to dire consequences for organizations attempting to safeguard their digital assets.

Defense Strategies Against GhostCode

Considering the severity of the threat, eSentire recommends several defensive measures to counteract GhostCode and similar phishing schemes. Organizations should limit the use of Microsoft’s device-code authentication flow via Conditional Access, disabling it for users who don’t require it. Proactive vigilance is vital. Keeping a watchful eye on the Device Registration Service can help spot suspicious registrations coming from single, non-interactive sessions.

Additionally, monitoring activities associated with Python-based requests post-device-code authentication is crucial. It can reveal ongoing attacks that would otherwise escape notice. Auditing Entra ID for devices that resemble GhostCode’s naming conventions and tracking successful device-code authentications can also aid in detecting breaches while they unfold. As eSentire emphasizes, the growing trend of exploiting device-code phishing warrants urgent attention from IT departments striving to secure their Microsoft 365 environments.

Implications and Future Outlook

What are the long-term implications of threats like GhostCode? For businesses increasingly reliant on cloud ecosystems, the risk and reality of sophisticated phishing attacks can’t be overstated. The evolution of phishing tactics means that conventional security measures may not suffice. As these threats become more intricate and tailored, organizations will need to revisit their cybersecurity protocols continuously.

This isn't just a matter of enhancing defenses but also involves educating users at every level. If you're working in this space, you know that combining technical safeguards with user awareness creates a more resilient security posture. The crux of the matter is clear: organizations must evolve alongside the attackers. Cybersecurity teams must act quickly and decisively, adopting new tools and practices that keep pace with emerging threats.

This article first appeared on Computerworld.