GhostCode attackers abuse device codes to take over Microsoft 365 accounts

Microsoft 365 users are facing a new phishing threat called GhostCode that exploits a legitimate device authorization flow. Researchers at eSentire discovered the campaign in late August 2026. GhostCode takes advantage of Microsoft’s OAuth 2.0 device authorization grant flow, which is designed for IoT devices and other non-browser-based logins.

The attackers pose as legitimate devices, generating a device code for the victim to enter on a separate browser. Once authenticated, the attacker gains access to the victim’s Microsoft 365 account and its associated tokens.

The attackers employ social engineering tactics by pretending to be procurement officers and sending an NDA-themed HTML file. Opening this file directs the victim to the GhostCode phishing page. Once authenticated, the attackers can register devices, obtain additional credentials, and establish persistence in the victim’s Microsoft environment.

Over 78 seconds, the attackers performed nine successful API calls, registering three devices and obtaining a Primary Refresh Token (PRT), which grants them SSO-equivalent access to the victim’s entire Microsoft 365 environment for the token’s lifetime.

To protect against GhostCode and similar attacks, eSentire recommends disabling device-code authentication for users who don’t require it and restricting the flow through Conditional Access. Monitoring the Device Registration Service for multiple device registrations from a single non-interactive session and looking for Python-based requests after device-code authentication can help detect an attack in progress.

Auditing Entra ID for devices with GhostCode’s naming pattern and correlating successful device-code authentication with suspicious activity can aid in detection. The company also provided a list of indicators of compromise for easier detection.