Play store
A new phishing kit called GhostCode is exploiting Microsoft 365’s device authorization process to hijack user accounts without stealing passwords.
According to an analysis by cybersecurity firm eSentire, the campaign tricks victims into completing multi-factor authentication (MFA) on a legitimate Microsoft webpage while unknowingly authorizing an attacker-controlled device to access their account. In one case, attackers registered three devices within 78 seconds.
eSentire identified the activity in late August and named the kit GhostCode after its hidden code and the GHOSTnet system used during device setup.
The campaign begins with messages sent through legitimate business contact forms. Attackers pose as procurement employees and ask targets to sign a non-disclosure agreement. They then send a WeTransfer link containing a password-protected HTML file.
The file mimics a document-sharing process and instructs victims to sign in using a Microsoft device code. The victim is directed to a genuine Microsoft page and approves the code, unknowingly granting the attacker’s device access to the Microsoft 365 account.
GhostCode abuses Microsoft’s OAuth device authorization flow, which is designed for devices that cannot easily display a full sign-in screen. The attacker’s server requests a code through the Microsoft Authentication Broker application, then embeds the code in a fake document portal.
The HTML attachment is designed to evade inspection. It contains excess data, hides visible text through HTML comments and conceals the redirect address until the correct password is entered.
The campaign also uses browser and location checks to filter automated scanners and security researchers. After authentication, attackers use residential proxy addresses that match the victim’s location, potentially making the activity appear less suspicious.
In one observed attack, eSentire recorded nine successful API calls, three device registrations within 78 seconds and acquisition of a Primary Refresh Token within 32 seconds. Such tokens can provide continued access to Microsoft 365 services without requiring repeated authentication.
Security teams are advised to monitor successful device-code authentications followed by unusual API activity or multiple device registrations. Suspicious device names, particularly those combining a user’s name, company domain and hexadecimal characters, should also be investigated.
Employees should be cautious when unexpected messages ask them to copy or approve a Microsoft device code, especially when the request comes through an unfamiliar business contact and is linked to a document or non-disclosure agreement.
GhostCode highlights a growing shift in phishing attacks from stealing passwords to exploiting legitimate authentication and authorization mechanisms. By using genuine Microsoft login pages, attackers can make account-takeover attempts appear like normal user activity.
