Loading story…
eSentire identified GhostCode, an active device-code phishing kit that impersonates businesses through contact-form messages and uses an NDA lure to steal Microsoft account authorization. Password-protected, heavily obfuscated HTML attachments decrypt phishing redirects in the victim’s browser, reducing detection by email scanners and sandboxes. The victim is directed to Microsoft’s legitimate device-code sign-in page, completes MFA, and unknowingly authorizes an attacker-controlled OAuth session.
The abuse targets Microsoft’s OAuth 2.0 device authorization grant, a legitimate workflow intended for input-constrained devices that issues a device and user code and can return access and refresh tokens after browser-based authentication. In an observed GhostCode intrusion, operators used stolen tokens and victim-geolocated residential proxies to register three Entra devices, obtain a Primary Refresh Token, access Microsoft Graph, and establish persistence within 78 seconds. Organizations should restrict device-code authentication with Conditional Access and investigate Entra events where device-code authentication is followed by python-requests activity or rapid device registrations.
Get the infrastructure and lures behind it.
5 events from the most recent confirmed update back to the earliest known activity.
A phishing campaign dubbed GhostCode used contact-form outreach, business impersonation, and an NDA-signing pretext to send password-protected HTML attachments that directed victims into Microsoft's device authorization flow.
Operators registered more than 30 domains impersonating U.S. distributors, manufacturers, warehousing firms, and other businesses, including the BJ's Wholesale Club lookalike bjssourcing[.]com.
eSentire revoked the compromised token grant, reset the victim's credentials, and disabled all three Entra devices enrolled by the attackers.
Within 78 seconds of device-code authentication, the operators made nine successful API calls, registered three Entra devices, and obtained a Primary Refresh Token at 17:26:24Z, 32 seconds after authentication. They then accessed Microsoft Graph and used python-requests/2.34.2 for subsequent API activity.
In an observed intrusion, a victim completed Microsoft sign-in and MFA using an attacker-supplied device code, allowing the operators to poll for and obtain authentication tokens. Five seconds after device-code authentication, the attackers began using the stolen token through victim-geolocated rotating residential proxies.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 18 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A phishing campaign abused Microsoft's OAuth 2.0 **Device Authorization Grant** (`Device Code Flow`) to capture valid Microsoft account tokens without sending victims to a counterfeit login page. Victims received emails posing as legal notifications, including password-protected PDF attachments, and were funneled through phishing pages that displayed a one-time device code before directing them to the legitimate `microsoft.com/devicelogin` page. After victims entered the code and completed normal MFA on Microsoft's real site, the attackers obtained `access_token`, `refresh_token`, and `id_token` values tied to attacker-controlled applications. The stolen tokens enabled persistent access to Microsoft services including **email, OneDrive, and Teams**, allowing attackers to read messages, access files, and monitor conversations. Researchers said the activity was observed from early April to mid-May 2026 and included a Brazil-focused variant that used legitimate redirect links, including on **cacoo.com**, to add credibility to the lure chain. Defenders were urged to reject unexpected device authorization prompts, inspect redirect parameters in otherwise legitimate URLs, disable Device Code Flow in Microsoft Entra ID where it is not needed, and monitor **DeviceCodeSignIn** and anomalous sign-in activity for signs of compromise.
Jul 9, 2026
Researchers and incident responders are warning that attackers are increasingly abusing Microsoft Entra ID's OAuth 2.0 **device code flow** to hijack Microsoft 365 accounts through legitimate sign-in prompts rather than malware or software exploits. In these attacks, victims are tricked via **vishing** or phishing into entering an attacker-supplied code at Microsoft's device login page and approving MFA, which issues the attacker valid access and refresh tokens. Security firms say the technique can provide broad access to services including **Microsoft Graph**, **Exchange Online**, **OneDrive**, and **SharePoint**, and that password resets alone may not fully contain the intrusion because refresh tokens can persist across services. The activity has been tied to data theft and follow-on abuse. ReliaQuest reported that the **Helix** extortion group used device code phishing, MFA abuse, and rogue authenticator registration to access victim Microsoft 365 tenants, enumerate SharePoint, and exfiltrate data before extortion; reported victims include Medtronic, Nissan, NAIC, Kodak, Infinite Campus, and the University of Nottingham. Separate investigations documented attackers signing in from foreign locations, registering multiple devices, creating hidden inbox rules to suppress replies, and using compromised mailboxes to send phishing messages at scale. Microsoft and security researchers recommend blocking or restricting device code authentication with **Conditional Access**, limiting SharePoint and device registration to managed devices, and monitoring Entra ID telemetry for `AuthenticationProtocol` set to device code, unusual travel, mailbox rule changes, and spikes in device registrations.
Jul 23, 2026
Attackers abused Microsoft’s OAuth 2.0 Device Authorization Grant flow to phish users into authorizing attacker-controlled sessions on legitimate Microsoft login pages, allowing them to capture **access tokens**, **refresh tokens**, and **ID tokens** without stealing passwords directly. In the observed campaign, victims received phishing emails, were routed through phishing landing pages and open redirects, and were told to enter attacker-supplied one-time device codes on Microsoft’s official device verification page before completing MFA. The stolen tokens enabled access to Microsoft 365 services including **email**, **OneDrive**, and **Teams**. Researchers also observed a Brazil-focused variant that used `cacoo.com`, a legitimate Nulab-owned service, as an open redirect to phishing infrastructure. Recommended mitigations include training users to reject unsolicited device-code requests, reviewing redirect parameters and final destinations, monitoring **DeviceCodeSignIn** events, enforcing device-compliance controls, and disabling Device Code Flow in Microsoft Entra ID where it is not required.
Jul 6, 2026