GhostCode is a phishing kit in which nothing the victim does looks wrong. The password is real, the multifactor prompt is real, and the sign-in completes exactly as Microsoft intends. Only the approval lands somewhere else.
The kit turned up in the wild in late August 2026. Credit for spotting it goes to eSentire’s threat response unit. GhostCode rides on the OAuth 2.0 device authorization grant, a flow built for hardware that cannot render a browser sign-in: a smart TV or printer shows a short code, and the owner types it into a Microsoft page to finish authenticating. The kit asks Microsoft to mint its own code, hands it to the target, and waits for the sign-in to complete. The tokens that come out belong to the attacker’s device.
Persistence in under two minutes
What happens after the login sets this kit apart. eSentire’s logs captured nine successful API calls inside 78 seconds. By the time that burst ended, the operator’s tooling had already touched Microsoft Intune Enrollment, the Device Registration Service, Azure Active Directory and Microsoft Graph. Registrations followed at the 28, 53 and 77-second marks after sign-in. Three devices went in, and eSentire reads that spacing as machine-driven, not manual.
With that foothold, the operators enrol hardware of their own, harvest further credentials and hold ground a password reset alone may not clear.
The lure is deliberately dull. Attackers open with a procurement enquiry sent through a website contact form, move the conversation to an NDA-themed HTML file, and that file drops the victim on the device-code page.
The practical asks are to alert on unexpected device registrations and Intune enrolments instead of dismissing them as inventory noise, and to restrict the device-code grant through Conditional Access wherever the business can live without it.
