When a Token Is Not the End: GhostCode and the New Identity Persistence Problem
A phishing kit tied to Microsoft Entra points to a harder cleanup problem for defenders: revoking a token may not be enough if the attacker has also touched device enrollment.
The uncomfortable shift in cloud abuse is no longer just about stealing a login. In this case, the risk appears to move deeper into the identity stack, where a victim can be pushed through a legitimate Microsoft sign-in flow and then left with attacker-controlled artifacts that are harder to unwind than a single session.
Fast Facts
- GhostCode is described as a device-code phishing kit tied to Microsoft Entra abuse.
- The kit is reported to keep access after stolen tokens are revoked, which raises the possibility of persistence beyond ordinary session cleanup.
- The lure starts with business-email social engineering rather than a fake login page.
- Operators reportedly impersonated procurement staff and used Salesforce contact forms as part of the outreach.
- Microsoft guidance treats device code flow as a high-risk authentication path and recommends blocking it where possible.
Why this matters technically
Device-code phishing is effective because it uses a real login service, not a cloned one. The user is tricked into entering a code on a legitimate Microsoft page, which means standard anti-phishing instincts can fail. From a defender’s view, the more important question is what happened after authentication. If an attacker also established device enrollment or another trusted device relationship, token revocation alone may not fully remove access.
That distinction matters. In Microsoft Entra and Intune environments, user sessions, refresh tokens, and device trust are related but not identical. Microsoft documentation shows that device enrollment creates management artifacts separate from a simple sign-in session. If a rogue device record exists, responders may need to remove that object, review device compliance, and check for lingering sign-in paths, not just reset passwords or revoke tokens.
There is also a broader operational lesson here: business-themed lures can bypass controls that are tuned to spot obvious credential-harvesting pages. A message that looks like procurement traffic, or a benign inquiry through a contact form, can still be the front end for an identity attack aimed at a Microsoft workflow.
At the time of writing, public information has not fully established the technical root cause, the complete scope of affected users, or whether downstream systems were compromised. The available information supports a risk analysis, not a definitive conclusion about full compromise.
Defensive lesson
The practical response is to treat suspicious Entra sign-ins as only the first layer of investigation. Hunt for unusual device-code activity, unexpected device registrations, and new Intune enrollment records. Where device code flow is not required, block it. Where it is required, restrict it tightly and monitor it closely.
GhostCode is a reminder that identity attacks are maturing. The target is no longer just the account. It is the trust relationship built around the account, the device, and the management plane that binds them together.
Conclusion
The deeper lesson is simple: in cloud environments, cleanup has to match the attacker’s foothold. If defenders only revoke tokens, they may miss the device-layer persistence that makes modern phishing campaigns harder to evict.
TECHCROOK
Hardware security key: A physical login key can add a stronger second factor for email and identity accounts. It is a practical option for people and teams that want to reduce reliance on codes sent by text or app prompts. Pair it with phishing-resistant authentication and keep a spare key stored securely.
WIKICROOK
- Device code flow: An OAuth sign-in method for constrained devices that uses a short code entered on a separate login page.
- Microsoft Entra: Microsoft’s identity and access management platform for authentication, authorization, and directory services.
- Device enrollment: The process of registering a device for management so it can be governed by enterprise controls.
- Token revocation: Invalidating authentication tokens to reduce or end access after suspected compromise.
- Conditional Access: Policy controls that decide when and how users or devices may authenticate.
