UpTrajectory Review

A new phishing kit called GhostCode is stealing Microsoft 365 accounts by abusing a legitimate authentication feature designed for devices that can't handle standard browser logins, according to researchers at eSentire's threat response unit who spotted the campaign in late August 2026. The technique, known as device-code phishing, tricks users into entering a code on Microsoft's real authentication page, which then grants the attacker access tokens instead of the user's own device. What makes this particularly insidious is that victims complete multifactor authentication as normal, believing they're securely logging in, when in fact they're authorizing an attacker-controlled device to access their account.

For small-business operators running on Microsoft 365, this is a direct threat to your operational backbone. The attack begins with social engineering: attackers pose as procurement officers through web contact forms, then lure victims into opening an NDA-themed HTML file that redirects to the phishing page. If your business handles procurement inquiries, vendor negotiations, or partnership discussions through your website, your team is precisely the target demographic here. The attackers aren't just stealing passwords; they're establishing persistent access that survives password changes and can be used to register additional devices, access email, and move laterally through your Azure environment.

What's genuinely alarming here is the speed and automation of the post-compromise activity. eSentire observed nine successful API calls in just 78 seconds after the initial authentication, hitting Microsoft Intune Enrollment, Device Registration Service, Azure Active Directory, and Microsoft Graph. Three attacker devices were registered in under a minute and a half. This isn't a manual attacker poking around; it's an automated playbook designed to entrench access before security teams can respond. The abuse of device-code phishing isn't entirely new, but GhostCode represents an industrialized, packaged version of the technique that lowers the barrier for less sophisticated threat actors.

The second-order effects extend beyond the initial account compromise. Because the attack leverages legitimate OAuth flows and valid tokens, traditional security controls like password complexity requirements and even MFA are insufficient. Your endpoint detection may not flag the activity because the authentication appears legitimate. If attackers gain persistent access to your Microsoft environment, they can read sensitive emails, access SharePoint and OneDrive files, and potentially pivot to compromise business partners or customers through your compromised accounts. For businesses in regulated industries, this could trigger breach notification obligations and compliance violations.

Watch for Microsoft to tighten controls around device-code authentication, potentially requiring additional verification steps or administrative approval for new device registrations. In the meantime, audit your conditional access policies in Azure AD to restrict device registration and consider blocking or heavily monitoring the device authorization flow if your organization doesn't legitimately use it. Train your procurement and sales teams to treat unexpected NDA requests or authentication prompts with extreme skepticism, especially those arriving through web forms. If you suspect compromise, don't just reset passwords—revoke all active sessions and registered devices, and investigate for persistence mechanisms that may have been established.

“The victim then signs in and completes multifactor authentication as normal — but the authentication is for the attacker-controlled device, allowing them to obtain the resulting authentication tokens.” — Computerworld

Takeaway: Audit your Azure AD conditional access policies to restrict device registration and consider blocking the OAuth device authorization flow if unused—MFA alone won't stop this attack.