New Phishing Kit Named GhostCode Exploits Microsoft Entra
In a concerning development in cybersecurity, a newly identified phishing tool known as GhostCode has emerged, revealing its capacity to exploit Microsoft Entra’s device enrollment process. This sophisticated kit is not merely a conventional phishing scheme; it effectively retains access even when stolen tokens are subsequently revoked.
GhostCode initiates its phishing attempt through social engineering tactics targeting businesses, a stark deviation from the traditional credential-harvesting methodologies typically seen in these attacks. The operators of GhostCode strategically impersonate procurement staff from legitimate organizations, notably including BJ’s Wholesale Club, and craft seemingly harmless inquiries using Salesforce contact forms. This method allows them to gain an initial foothold in the target organization.
Once the sales team from the targeted organization responds to these inquiries, the attackers introduce what they present as a routine Non-Disclosure Agreement (NDA) signing procedure. Subsequently, they send a password-protected HTML attachment via WeTransfer, further enhancing the deceptive nature of their approach.
The infrastructure underlying this campaign suggests a level of scale that raises alarms for cybersecurity experts. Researchers at eSentire have linked the sender domain, bjssourcing[.]com, to over 30 recently registered lookalike domains. These domains, which impersonate U.S. distributors, manufacturers, and warehouse firms, are mail-enabled but lack active websites—an operational pattern frequently observed in business email compromise staging.
The attachment, which poses as a document-sharing portal named FlipBook, employs a trio of evasion tactics to bypass detection mechanisms. The first tactic includes the incorporation of significant amounts of repeated junk data, which artificially inflates the HTML file size. This inflation complicates the work of similarity-hash and scanning programs designed to flag suspicious content.
Secondly, GhostCode injects HTML comments interspersed among visible characters. This approach allows the web browser to render what appears to be normal text while simultaneously obfuscating the HTML source. Such a tactic makes static parsers, regex rules, and text extraction systems struggle to analyze the content properly.
The third layer of GhostCode’s evasion strategy is the use of AES-256-GCM encryption for the next-stage redirect. This means that the phishing URL will only be decrypted in the browser after the victim has entered the attacker-supplied password. The decryption key is generated via PBKDF2-HMAC-SHA256, utilizing a hard-coded salt along with the password provided by the victim. Furthermore, Web Crypto API functions handle the redirection, preventing sandboxes, mail gateways, and proxy systems from seeing the actual phishing destination unless they perform the password-gated workflow correctly.
Once the victim enters the correct credentials, they are funneled through an array of security measures, including a JavaScript-based anti-bot utility known as Cloudflare Turnstile, server-side GeoIP checks, and user-agent filtering. The ultimate phishing page is hosted on a subdomain of what appears to be a legitimate site, crafted as an aesthetically convincing document portal rather than a mere clone of Microsoft’s login page.
The implications of the GhostCode phishing campaign are particularly alarming. Researchers at eSentire’s Threat Response Unit observed this operation in late August 2026, illustrating how attackers can manipulate a single Multi-Factor Authentication (MFA)-approved device-code login to generate multiple attacker-controlled Entra devices.
Rather than simply stealing a password, GhostCode executes a device-code request as an OAuth client, displaying Microsoft-issued user codes to its victims. The HTML file titled “3arhCt9c0p.html” is password-protected, masquerading as a document-sharing service. Victims who input the code directed to Microsoft’s legitimate device login page unwittingly complete their typical sign-in processes, including MFA, which complicates their recognition of the attack.
The authentication appears valid from Microsoft’s viewpoint, posing significant risks for organizations. Microsoft has recommended blocking the device-code flow in scenarios where it is not explicitly required, advising the use of Conditional Access authentication-flow controls.
GhostCode’s operators reportedly made use of Microsoft Authentication Broker’s application ID while requesting Microsoft Graph default permissions in conjunction with offline_access. When a victim clicks the “Authenticate” button on the phishing page, they unknowingly redirect their browser to the actual Microsoft sign-in page.
Upon approval, the kit retains the device code and begins polling for successful authorization, subsequently leading the victim to an ostensibly innocent NDA PDF to further lessen suspicion. However, it is the post-compromise activities that reveal the campaign’s most critical facet. Within mere seconds of successful authentication, the attackers begin making API calls to various Microsoft services, such as Intune Enrollment and Windows Azure Active Directory, successfully registering three new Entra devices and obtaining a Primary Refresh Token (PRT).
A PRT facilitates single sign-on capabilities across tenant resources and typically symbolizes a managed device. The immediate consequence of this is that even if the initial session or refresh token is revoked, the attackers might still have a foothold if rogue enrolled devices remain within the tenant.
eSentire has noted that the entries made by attackers into the Intune Enrollment records persist unless manually removed, even following the revocation of tokens. The attackers have also demonstrated a sophisticated approach by rotating their IP addresses through residential proxy infrastructures, primarily utilizing UK exit nodes to align with the victim’s location and enhance the credibility of the Microsoft device-authentication prompt.
In light of these revelations, organizations investigating potential device-code phishing incidents are urged to prioritize the containment of rogue device registrations rather than merely revoking sessions. Microsoft has issued corresponding emergency response guidance, which suggests deactivating affected accounts and revoking refresh tokens, along with disabling registered devices linked to the compromised user.
Security teams should monitor Entra sign-in logs for deviceCode authentication activity, rapid API calls to Device Registration Services, and unusual patterns indicative of unauthorized Microsoft Graph sessions. Immediate detection will require vigilance regarding unusual user agent identifiers and device names that mirror user identities.
To mitigate such threats proactively, organizations are advised to block device-code flows for users lacking documented business justifications, and to pilot new policies in a report-only mode. Maintaining tightly controlled exception groups for legitimate use cases, such as shared devices and IoT applications, will also be critical in reinforcing security defenses against evolving phishing attacks like GhostCode.