Leadership1 publisher3 min readPublished
Revoking the stolen tokens left GhostCode's Intune device inside the tenant
eSentire says a phishing kit called GhostCode used Microsoft's device-code flow to register three devices within 77 seconds of a victim completing MFA, and one of them stayed enrolled in Intune until it was explicitly removed.
The Board Room · Leadership desk
What happened
- eSentire's threat response unit identified GhostCode, a phishing kit that exploits Microsoft's OAuth 2.0 device authorization grant flow to take over Microsoft 365 accounts, in late August 2026.
- The victim signs in and completes multifactor authentication as normal, but the authentication belongs to the attacker-controlled device, which collects the resulting tokens.
- The attackers also obtained a Primary Refresh Token, a credential eSentire said persists 14 days by default.
Compiled by The Board RoomSomething wrong?How this is made
Why it matters
- constraint The only services eSentire put beyond the stolen token's reach are those covered by a Conditional Access policy requiring a compliant device, so coverage has to be established service by service before anyone can say what is protected.
- decision Blocking the device-code flow is a decision about which hardware loses the ability to sign in, because the flow exists for printers, smart TVs and other devices that cannot run a browser login.
- exposure An incident procedure that stops at revoking sessions hands back a tenant with the attacker's enrolled device still in it.
- precedent With the technique packaged in kits sold as a service, a subscription is enough to run it, so more groups can reach the same flow.
eSentire's recommendation contains two different Conditional Access policies, and only one of them is a switch. The first restricts the device-code authentication flow and disables it for users who do not need it [15]. The second appears in eSentire's own account of what the stolen credential buys: the firm said the Primary Refresh Token "gives the threat actors essentially SSO-equivalent access to the victim's entire M365 environment for the PRT's lifetime" [11], with the reachable surface including "any service not explicitly protected by a Conditional Access policy requiring a compliant device" [12].
Turning the flow off has a specific cost. It exists so that hardware which cannot easily run a browser login, such as IoT devices, smart TVs and printers, can authenticate [2]. A tenant-wide block breaks whatever in the estate relies on it, so inventory the estate before writing the policy.
The timings point to automation. eSentire counted nine successful API calls in 78 seconds after access was granted, touching Microsoft Intune Enrollment, the Device Registration Service, Azure Active Directory and Microsoft Graph [7]. The three device registrations came at 28, 53 and 77 seconds, gaps of 25 and 24 seconds [8][20]. eSentire said the sequence was automated [8]. Its detection advice matches that speed: watch the Device Registration Service for multiple registrations from a single non-interactive session, and look for the python-requests user agent after a device-code authentication [16].
The persistence finding is the part that changes an existing runbook. eSentire said the third device was enrolled into Intune, that the enrollment survived token revocation, and that the attacker-created device stayed in the tenant until it was explicitly removed [9]. In most identity incident procedures, revoking sessions is the first containment step. It ends the token, leaves the device object in place, and the object has to be deleted separately.
The technique predates this kit. The report cites the EvilTokens phishing-as-a-service kit and a campaign KnowBe4 reported in February 2026 [18], along with later activity involving both financially motivated and state-sponsored clusters [19]. What GhostCode adds is the delivery and the follow-through. Attackers posed as procurement officers through a web contact form, then moved the conversation to an NDA-themed HTML file that opened the device-code page [6], which sat behind Cloudflare Turnstile, bot checks, encrypted redirects and padded, obfuscated HTML [14].
eSentire called the PRT "one of the most powerful" credentials in a Microsoft identity environment [10] and said it persists 14 days by default [13], which is 336 hours of access won by 78 seconds of automated calls [21]. One vendor's telemetry carries all of this, and the report does not say how many organisations were affected [22]. eSentire's closing advice is an audit: check Entra ID for devices matching GhostCode's naming pattern, correlate successful device-code authentications with subsequent Python-based requests, and use the indicators of compromise the firm published [17].
What to watch
- Whether Microsoft changes the default availability of the device-code flow or the 14-day PRT lifetime.
- Whether other responders report the same 25-second registration cadence, which would point to a shared toolkit across operators.
- Whether eSentire's published indicators hold as GhostCode's device naming pattern changes.