eSentire Threat Response Unit blog (published 15 September 2026, 7:00 am US Eastern; 7:00 pm Perth) details GhostCode, a novel OAuth 2.0 device-authorization phishing kit that hijacks Microsoft 365 accounts after the victim completes legitimate MFA on Microsoft's real sign-in page. Observed chain: Salesforce contact-form lure posing as a procurement officer for BJ's Wholesale Club, sales follow-up, NDA pretext, then a WeTransfer link to a password-gated HTML lure using three evasion layers (junk padding, character-level HTML comment injection and an AES-256-GCM-encrypted redirect URL); a Cloudflare Turnstile gate filters scanners before the device-code page.

Kit requests a user_code using the Microsoft Authentication Broker application ID, presents a polished fake document portal, and captures tokens once the victim approves the attacker's device. eSentire describes Primary Refresh Token capture and, in one intrusion, nine successful API calls with the stolen token across a 78-second period and three devices registered within 78 seconds, with rotating residential proxy IP addresses matching the victim's geolocation. Distinct from password-stealing kits; MFA does not stop the flow because the victim authenticates Microsoft directly.

Defenders: restrict or block device-code grant where unused, alert on Authentication Broker device registrations, treat unexpected WeTransfer/NDA procurement mail as high-risk, review Entra ID sign-in and device logs. (source: eSentire TRU)

Correction (26 Oct 2026): removed the Cyber Security News credit and link; every detail on this card is from eSentire's report, and the title no longer describes the 78-second window as an MFA bypass time. (source: eSentire)