eSentire Threat Response Unit

eSentire finds GhostCode phishing Microsoft device codes through web contact forms

eSentire's Threat Response Unit says the GhostCode kit abuses Microsoft's OAuth 2.0 device authorization grant, and the lure reached targets in late August 2026 as a procurement inquiry filed through a company's own web form.