Press play to start listening
Cybersecurity researchers at eSentire have uncovered a phishing kit designed to hijack Microsoft accounts by abusing a legitimate OAuth authorization flow. Named GhostCode by eSentire’s Threat Response Unit (TRU), the kit was observed registering three attacker-controlled devices and completing an Intune enrollment within 78 seconds of authentication
Fake Procurement Inquiries Lead to Compromise
The campaign in which researchers spotted the phishing kit began in late August 2026, when attackers contacted a sales team through a Salesforce web form, posing as a procurement officer for BJ’s Wholesale Club.
They used the lookalike domain bjssourcing.com, registered 15 days before the outreach. TRU identified more than 30 similar domains registered in August, including domains made to look like US distributors, manufacturers, and other companies.
The sales team was then told that an NDA would be sent by email. That email included a WeTransfer link to a password-protected HTML file called 3arhCt9c0p.html. The file had three layers designed to make analysis harder: junk padding made up of repeated characters, HTML comments placed between individual characters, and an encrypted redirect URL. The URL was protected with AES-256-GCM, with the key derived from the password using PBKDF2-HMAC-SHA256.
GhostCode Abuses Microsoft Device Authentication
The decrypted URL sent victims through a JavaScript challenge and Cloudflare Turnstile before reaching a phishing page on a likely compromised chiropractic website. The page abused Microsoft’s OAuth 2.0 device authorization grant, a legitimate login method intended for devices such as smart TVs.
The phishing server requested a device authorization code using Microsoft Authentication Broker App ID 29d9ed98-a469-4536-ade2-f981bc1d605e. It displayed the resulting user code and instructed the victim to enter it on Microsoft’s genuine sign-in page. After the victim authenticated and completed MFA, GhostCode obtained the resulting tokens and displayed a decoy NDA on BJ’s Wholesale Club letterhead.
Three Devices Registered in 78 Seconds
According to the company’s blog post shared with Hackread.com, the attackers began using the stolen token five seconds after authentication. Within 78 seconds, they registered three devices in Microsoft Entra ID and completed an Intune enrollment.
A Primary Refresh Token (PRT) was obtained after 32 seconds, providing SSO-equivalent access to Microsoft 365 resources for its lifetime, except where Conditional Access policies required a compliant device. TRU also observed email harvesting.
GhostCode used residential proxies to make requests appear geographically consistent with the victim, while subsequent API activity included the python-requests/2.34.2 user agent. TRU detected the activity through anomalous Entra non-interactive sign-in logs, then revoked the token grant, reset the account credentials, and disabled the three attacker-enrolled devices.
The technique is becoming more common. Microsoft has previously linked device-code phishing to Storm-2372, which used the technique to trick targets into authenticating and then used the resulting tokens to access Microsoft 365 services. Huntress later linked another device-code phishing campaign, which affected 344 organizations across five countries in March 2026, to the EvilTokens phishing-as-a-service kit.
GhostCode does not rely on a CVE or malware installation. Because the victim completes Microsoft’s legitimate authentication process, the resulting token carries the MFA claim and can be used for subsequent access without another MFA challenge.
Expert’s View
Commenting on the attack, Michael Jenkins, CTO at ThreatLocker, said the case shows why MFA alone is no longer enough and why organizations also need to verify the device requesting access. He shared the following comments with Hackread.com, stating:
“In this case, the victim completes a Microsoft authentication process, but the attacker walks away with a valid token they can use to gain access. It’s another example of why MFA alone is no longer enough. Authentication should also verify that access is coming from an approved device so a stolen credential won’t work on an untrusted machine. Device identity needs to become another required layer of how we protect accounts online.”
