GhostCode Phishing Kit Abuses Device Codes to Take Over Microsoft 365 Accounts

A new phishing kit called GhostCode has been identified by researchers at eSentire's threat response unit, which targets Microsoft 365 users by exploiting a weakness in the OAuth 2.0 device authorization grant flow.

The attackers pose as procurement officers and use social engineering to trick victims into handing over their access to their accounts. They then convince the victim to enter a code on Microsoft's authentication page, allowing them to obtain authentication tokens that can be used to register devices and establish persistence in the victim's Microsoft environment.

eSentire recorded nine successful API calls made by the attackers over a 78-second period, involving services such as Microsoft Intune Enrollment, Azure Active Directory, and Microsoft Graph. The attackers also obtained a Primary Refresh Token (PRT), which grants them SSO-equivalent access to the victim's entire M365 environment for up to 14 days.

To defend against attacks like this, eSentire recommends restricting Microsoft's device-code authentication flow through Conditional Access and monitoring the Device Registration Service for multiple device registrations from a single non-interactive session.