GhostCode Phishing Kit Bypasses MFA

Microsoft 365 accounts are being compromised through a new phishing kit that tricks users into authorizing attacker-controlled devices, effectively bypassing multifactor authentication. The kit, dubbed GhostCode, exploits the legitimate OAuth 2.0 device authorization grant flow, according to research from eSentire's threat response unit, which identified the campaign in late August 2026.

How the device-code flow works

The device authorization grant flow was designed for devices that cannot easily support a browser-based login — think IoT devices, smart TVs, or printers. In this flow, the device displays a code that the user enters in a browser on a separate device to complete authentication. This mechanism is known as device-code phishing, and it has been abused in other attacks before.

GhostCode poses as one such device, prompting Microsoft's OAuth service to generate a device code. The victim is then convinced to enter that code on Microsoft's legitimate authentication page. After signing in and completing multifactor authentication as usual, the victim unwittingly authorizes the attacker's device. The attacker then obtains the resulting authentication tokens, which are used to register additional attacker-controlled devices, obtain further credentials, and establish persistence within the victim's Microsoft environment.

Social engineering lures victims

In the campaign observed by eSentire, the attackers employed a social-engineering setup. They posed as procurement officers through a web contact form and moved the conversation to an NDA-themed HTML file. Opening that file redirected the victim to the device-code phishing page.

To evade detection, the attackers used multiple techniques: padding and obfuscating the HTML code in their lure, encrypting redirects, checking for bots, and using Cloudflare Turnstile to keep security tools away from the phishing page.

From tokens to persistence

Once access was granted, eSentire recorded nine successful API calls over a 78-second period. These involved Microsoft Intune Enrollment, the Device Registration Service, Azure Active Directory, and Microsoft Graph. Three devices were registered during that time — at 28, 53, and 77 seconds after authentication — a sequence eSentire said was automated.

The third device was also successfully enrolled into Intune, Microsoft's cloud-based device management service. eSentire noted that Intune enrollment survived token revocation: the attacker-created device remained in the tenant until it was explicitly removed.

The attackers also obtained a Primary Refresh Token (PRT), which eSentire called “one of the most powerful” credentials in a Microsoft identity environment.

“Obtaining a PRT via device code abuse gives the threat actors essentially SSO-equivalent access to the victim’s entire M365 environment for the PRT’s lifetime — including any service not explicitly protected by a Conditional Access policy requiring a compliant device,”

— eSentire

The token persists 14 days by default.

Defending against GhostCode

eSentire's researchers recommend restricting Microsoft's device-code authentication flow through Conditional Access and disabling it for users who do not need it. They also advise monitoring the Device Registration Service for multiple device registrations from a single non-interactive session, and looking for activity involving the user agent python-requests following device-code authentication.

Auditing Entra ID for devices matching GhostCode's naming pattern and correlating successful device-code authentication with subsequent Python-based requests should be able to catch an attack in progress, the company said. It shared a list of indicators of compromise related to the campaign to aid detection.

Part of a broader trend

GhostCode adds to a growing number of attacks abusing device-code phishing to target Microsoft's OAuth authentication flow. Recent examples include attacks using the EvilTokens phishing-as-a-service (PhaaS) kit, a campaign reported by KnowBe4 in February 2026, and activity observed in December 2026 involving multiple clusters, including both financially motivated and state-sponsored actors.

What it means for defenders

The GhostCode campaign highlights the continued effectiveness of device-code phishing as a means to bypass MFA and gain persistent access to Microsoft 365 environments. For defenders, the attack underscores the importance of restricting device-code authentication where it is not needed, monitoring for anomalous device registrations, and correlating authentication events with subsequent API activity. As these attacks grow in frequency and sophistication, organizations should review their Conditional Access policies and ensure that they have visibility into device registration and token usage across their Microsoft estates.