GhostCode Exploits Microsoft Device Codes to Steal M365 Tokens and Enroll Rogue Devices eSentire’s Threat Response Unit (TRU) has identified a previously undocumented device-code phishing kit, dubbed “GhostCode,” which abuses Microsoft’s OAuth 2.0 device authorization grant flow to hijack M365 accounts, mint Primary Refresh Tokens (PRTs), and silently enroll rogue devices within approximately 78 seconds of a victim completing MFA. Threat actors impersonated a procurement officer for BJ’s Wholesale Club and submitted a benign inquiry through a target company’s Salesforce contact form, using a 15-day-old lookalike domain, bjssourcing[. ]com.

This tactic utilizes three layers of evasion: oversized files that expand file size and circumvent similarity hashing; injecting HTML comments between every letter to bypass regex and NLP-based phishing classifiers; and an AES-256-GCM encrypted redirect URL whose decryption key is derived client-side via PBKDF2-HMAC-SHA256 from the attacker-supplied password, concealing the destination until the victim enters it. Every request utilized fresh UK residential IPs, with one German IP tied to ASN 12586 (GHOSTnet GmbH), giving the kit its name alongside the obfuscated HTML code. Recommended defenses include disabling device-code authentication via Conditional Access for all but essential accounts, enforcing MDM-based device compliance, and monitoring for python-requests user agents combined with rapid, multi-device registrations from a single sign-in session.