GhostCode, a device-code phishing kit discovered in late August 2026, exploits Microsoft Entra device enrollment to maintain persistent access after token revocation. Attackers use business-email-compromise social engineering to deliver password-protected HTML lures masquerading as document portals. Upon phishing successful MFA-approved OAuth device-code authentication, operators automatically register rogue Entra devices and obtain Primary Refresh Tokens (PRTs), establishing tenacious footholds that persist even after original stolen tokens are revoked. Infrastructure analysis identified over 30 lookalike domains impersonating U.S. distributors and manufacturers.
// Get alerts for Microsoft Azure