{
  "id": 8263683,
  "title": "GhostCode attackers abuse device codes to take over Microsoft 365 accounts",
  "url": "https://urgent.news/2026/09/18/ghostcode-attackers-abuse-device-codes-to-take-over-microsoft-365",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-18T15:16:22.000Z",
  "source": {
    "name": "Computerworld",
    "slug": "computerworld",
    "url": "https://www.computerworld.com/article/4223889/ghostcode-attackers-abuse-device-codes-to-take-over-microsoft-365-accounts.html"
  },
  "original_language": "en",
  "account": "Microsoft 365 users are facing a new phishing threat called GhostCode that exploits a legitimate device authorization flow. Researchers at eSentire discovered the campaign in late August 2026. GhostCode takes advantage of Microsoft’s OAuth 2.0 device authorization grant flow, which is designed for IoT devices and other non-browser-based logins. The attackers pose as legitimate devices, generating a device code for the victim to enter on a separate browser. Once authenticated, the attacker gains access to the victim’s Microsoft 365 account and its associated tokens.\n\nThe attackers employ social engineering tactics by pretending to be procurement officers and sending an NDA-themed HTML file. Opening this file directs the victim to the GhostCode phishing page. Once authenticated, the attackers can register devices, obtain additional credentials, and establish persistence in the victim’s Microsoft environment. Over 78 seconds, the attackers performed nine successful API calls, registering three devices and obtaining a Primary Refresh Token (PRT), which grants them SSO-equivalent access to the victim’s entire Microsoft 365 environment for the token’s lifetime.\n\nTo protect against GhostCode and similar attacks, eSentire recommends disabling device-code authentication for users who don’t require it and restricting the flow through Conditional Access. Monitoring the Device Registration Service for multiple device registrations from a single non-interactive session and looking for Python-based requests after device-code authentication can help detect an attack in progress. Auditing Entra ID for devices with GhostCode’s naming pattern and correlating successful device-code authentication with suspicious activity can aid in detection. The company also provided a list of indicators of compromise for easier detection.",
  "summary": "Microsoft 365 users are being tricked into handing over access to their accounts by a new phishing kit, GhostCode, that exploits a weakness in a legitimate device authorization flow. Researchers in eSentire’s threat response unit identified the campaign in late August 2026. The kit abuses Microsoft’s OAuth 2.0 device authorization grant flow, a legitimate mechanism designed to enable…",
  "key_points": [
    "GhostCode attacks Microsoft 365 accounts via device codes.",
    "Researchers at eSentire discovered the campaign in late August 2026.",
    "Attackers exploit OAuth 2.0 device authorization flow for device registration."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}