InfoSecBulletin Cybersecurity for mankind
GhostCode is a new phishing kit that changes a regular Microsoft 365 sign-in into an account theft. It doesn’t need to hack a password. Instead, it tricks people into letting criminals into their work accounts.
The campaign started with normal messages sent through business contact forms. Attackers pretended to be procurement staff, asked to sign a non-disclosure agreement, and then sent a WeTransfer link with a password-protected HTML file.
FortiBleed Attack Compromised 80,000+ Devices, SonicWall Patches 4 SMA1000 Flaws CVSS 10
Contract and server dispute brought down Bangladesh’s digital payment
Critical Atlassian & IBM Flaws Expose Files and Enable Remote Code Execution
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
The file showed a way to share documents and told the person to sign in with a Microsoft device code. eSentire’s analysts found this activity in late August and called the kit GhostCode. The name comes from its secret code and the GHOSTnet system used during device setup.
The danger is real because the victim logs in, using multi-factor authentication, on a real Microsoft page.
GhostCode then gets the token, tricks the victim with a fake NDA, and starts working before the victim notices something is wrong. This case shows why phishing attacks using device codes are hard to detect with usual password theft signs.
The campaign shows that trust in a known identity page, not a technical issue, can help attackers. For organizations that rely on the cloud, this difference makes a normal approval request a big security problem. It can happen before investigators see the first alert.
GhostCode Phishing Kit Bypasses Microsoft 365 MFA
GhostCode abuses the OAuth device authorization process, which is intended for devices such as smart televisions that cannot easily display a full sign-in screen.
Its server asks for a code with the Microsoft Authentication Broker app ID, puts that code into a fake document portal, and tells the target to approve it. The user is really giving permission to the attacker’s device.
The attachment makes it hard to inspect. It is filled with extra data, hides the visible text with HTML comments, and keeps its redirect address secret until you enter the right password.
After the victim visits the phishing server, a browser test and location checks filter out automated scanners. This method is similar to what was seen in the EvilTokens phishing service, but GhostCode mixes it with targeted contact-form outreach.
Once the sign-in gets approved, the kit uses home proxy addresses picked to match where the victim is. This makes the Microsoft prompt less shocking and can lower alerts based on the location.
Attackers made nine successful API calls, registered three devices in 78 seconds, and got a Primary Refresh Token in 32 seconds. This token lets users sign in to Microsoft 365 services without re-authenticating.
Organizations should use device rules when needed. This lowers the chance that workers will be fooled by the same tricks used in passkey phishing scams.
Security teams need to warn about successful device-code events that are followed by strange scripted requests or multiple device registrations from one session. They should also look for device names that match a first name, last name, company domain, and hexadecimal pattern.
User awareness is still key: an unexpected ask to copy a code into a Microsoft page should be seen as suspicious, especially since Microsoft 365 session theft campaigns are now targeting tokens more than passwords.
