Researchers observed a real phishing campaign using a kit called GhostCode that abuses Microsoft’s legitimate “device code” sign-in flow to steal authentication tokens. Victims are socially engineered to open an NDA-themed HTML file and then enter a device code on Microsoft’s login page, unintentionally authorizing an attacker-controlled device. The stolen tokens are then used to register devices and maintain persistent access to the victim’s Microsoft 365 environment.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get a legit-looking procurement inquiry on your website, then an NDA to review. Normal day, right? But this is GhostCode. That HTML NDA quietly sends you to a Microsoft page asking you to enter a device code to view the document. You sign in and pass MFA like normal, but here’s the twist: you just approved an attacker-controlled device. They grab your tokens, register devices, even enroll one into Intune that can survive token revocation. Aha moment: NDAs do not need a device code. If you’re ever told to enter a Microsoft device code just to open a document, stop and call IT before you touch it.
Microsoft reports that the EvilTokens phishing-as-a-service platform helped criminals compromise thousands of organizations by tricking users into completing a legitimate Microsoft “device code” login. The lure drives victims to enter a short code at microsoft.com/devicelogin, which unknowingly…
Researchers observed real campaigns where a fake “AI crypto trading agent” website tricked victims into downloading malware that silently replaces browser wallet extensions and steals the wallet password when it’s typed. The same reporting also describes invoice emails using QR codes to push…
Researchers observed a real phishing campaign that abused Microsoft 365’s Direct Send feature to make emails look like they came from the victim organization’s own domain, without compromising an employee account. The campaign was timed to mimic human sending patterns during U.S. Eastern business…
This weekly recap highlights multiple real-world campaigns where attackers trick users into taking actions that grant access, without needing to steal passwords directly. Notable examples include “device code” phishing (victims are instructed to enter a short code to approve an attacker session)…
This weekly threat bulletin describes real incidents where attackers used human manipulation to break in, including social engineering at Levi Strauss and a Microsoft 365 credential-theft phish at defense supplier IEH. It also highlights a Lazarus-linked campaign using fake job offers and…
Researchers tied North Korea’s Lazarus Group to a real-world campaign that approaches professionals with convincing fake recruiter outreach and job offers. Victims are tricked into opening a malicious PDF or installing a fake PDF viewer from lookalike websites, which then installs backdoors and can…
