A sophisticated new phishing kit called GhostCode is putting Microsoft 365 accounts at risk across organizations worldwide. Attackers are abusing a legitimate authentication mechanism to bypass traditional defenses — and the result is persistent access that is extremely difficult to revoke.
How the GhostCode Attack Works
The Device Code Flow Mechanism
GhostCode exploits what is known as the device code flow, an OAuth 2.0 protocol originally designed for browser-less devices. Under normal circumstances, this flow allows smart TVs and industrial terminals to authenticate against cloud services. Attackers have turned it into a weapon.
The process is deceptively simple. The victim receives a convincing phishing email containing what appears to be a legitimate device code. The user enters it into the Microsoft portal — and at that moment, the authentication token is captured by the attacker.
What makes this especially insidious is the timing. A device code remains valid for roughly 15 minutes, giving attackers ample time to prepare their infrastructure in advance and simply wait for the victim to take the bait.
Why Traditional Defenses Fall Short
Classic phishing aims to steal usernames and passwords. GhostCode takes a fundamentally different approach: it obtains a valid OAuth token directly, bypassing multi-factor authentication (MFA) entirely.
As a result, security tools that rely on detecting compromised credentials are rendered ineffective. The token appears completely legitimate — Microsoft Entra ID recognizes it as an authentic session, raising no immediate alarms.
Post-Revocation Persistence: The Most Dangerous Feature
Abusing Microsoft Entra Device Enrollment
Research by eSentire has uncovered a particularly alarming capability. GhostCode does not stop at obtaining temporary access. Attackers leverage the stolen token to register a new device within Microsoft Entra ID.
This device registration generates additional credentials that survive the revocation of the original token. Even if the victim changes their password, the attackers retain their foothold.
To make matters worse, the attacker-registered device appears legitimate within the environment. Security teams struggle to distinguish it from a genuine corporate endpoint — a fact that significantly complicates incident response operations.
Operational Impact on Organizations
The consequences extend well beyond the technical. Persistent access to Microsoft 365 means access to email, SharePoint, Teams, and OneDrive. Attackers can exfiltrate sensitive data for weeks, and can use the compromised account as a launchpad for internal lateral movement.
The Business Email Compromise (BEC) risk is particularly acute. A hijacked executive account can be used to authorize fraudulent wire transfers or send misleading communications to partners and suppliers. The financial fallout can be severe.
Mitigating the Risk: Recommendations for CISOs
Block Device Code Flow Where It Isn’t Needed
The most straightforward line of defense is also the most effective. Microsoft allows organizations to block the device code flow through Conditional Access policies. Any organization that does not manage IoT devices or specialized terminals should disable this flow for all users.
Applying granular conditional access policies — restricting authentication flows to only the scenarios that genuinely require them — dramatically reduces the attack surface. Microsoft itself has published recommended configurations, already documented on Windows Forum.
Monitoring and Incident Response
Organizations must also strengthen their monitoring posture. Every new device registration in Entra ID should be tracked, and any device enrolled outside official IT channels must be investigated immediately.
User awareness training is equally critical. Employees need to understand that no legitimate process will ever ask them to enter a device code received via email. Human awareness remains a core defensive tool.
SOC teams should also integrate device code phishing scenarios into their playbooks. In this type of attack, the speed of response in the first few minutes following fraudulent authentication can make all the difference.
Conclusion
GhostCode represents a meaningful evolution in phishing tactics. By abusing legitimate protocols, it sidesteps established defenses with ease. Its post-revocation persistence makes it especially difficult to neutralize once a compromise has occurred.
In this threat landscape, prevention is the only truly effective strategy. Blocking the device code flow where it serves no purpose, monitoring device registrations closely, and investing in user education are steps that organizations can no longer afford to delay.
Sources:
- eSentire – GhostCode Dissecting a Novel Device Code Phishing Kit
- CyberPress – GhostCode M365 Device Code
- GBHackers – GhostCode Abuses Microsoft Entra
- Windows Forum – Block Device Code Flow Against GhostCode
- CybersecurityNews – GhostCode Phishing Kit
- Varutra – GhostCode Exploits Microsoft Entra Device Enrollment
- CSO Online – Original Source
The rise of techniques like GhostCode — capable of bypassing MFA and surviving token revocation — underscores how critical timely threat intelligence sharing has become for organizations of all sizes. Platforms like IsacChain enable the secure, verified exchange of indicators of compromise across ISACs and regulated sectors, while supporting automated NIS2 compliance through documented workflows and immutable audit trails backed by blockchain verification. In a threat environment where the first few minutes after a fraudulent authentication event can determine the outcome, access to shared and traceable intelligence is a concrete defensive advantage. Discover how IsacChain can help your organization at www.isacchain.com