GhostCode Phishing Kit Targets Microsoft 365 Accounts

• •GhostCode exploits OAuth 2.0 for device code phishing targeting Microsoft 365.
• •Attackers use social engineering tactics, including impersonation and decoy documents.
• •Over 30 lookalike domains registered indicate a broader phishing campaign.

In late August 2026, eSentire's Threat Response Unit identified a phishing campaign dubbed 'GhostCode' that exploits Microsoft’s OAuth 2.0 device authorization flow to compromise Microsoft 365 accounts. Attackers impersonate procurement officers and lure victims into entering device codes on a phishing page that appears legitimate. Once victims authenticate, attackers gain access to authentication tokens, allowing them to register devices and maintain persistence within the victim’s Microsoft environment. The campaign has seen over 30 lookalike domains registered, indicating a broader targeting effort. The attackers employed social engineering tactics, including a decoy NDA document, to facilitate the attack. This method allows attackers to obtain long-lasting access tokens, including Primary Refresh Tokens (PRTs), which provide extensive access to the victim's Microsoft 365 environment. The attack's automation and evasion techniques, such as obfuscation and bot checks, enhance its effectiveness.