Researchers observed a real phishing campaign using a kit called GhostCode that abuses Microsoft’s legitimate “device code” sign-in flow to steal authentication tokens. Victims are socially engineered to open an NDA-themed HTML file and then enter a device code on Microsoft’s login page, unintentionally authorizing an attacker-controlled device. The stolen tokens are then used to register devices and maintain persistent access to the victim’s Microsoft 365 environment.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get a legit-looking procurement inquiry on your website, then an NDA to review. Normal day, right? But this is GhostCode. That HTML NDA quietly sends you to a Microsoft page asking you to enter a device code to view the document. You sign in and pass MFA like normal, but here’s the twist: you just approved an attacker-controlled device. They grab your tokens, register devices, even enroll one into Intune that can survive token revocation. Aha moment: NDAs do not need a device code. If you’re ever told to enter a Microsoft device code just to open a document, stop and call IT before you touch it.
Researchers observed real campaigns where a fake “AI crypto trading agent” website tricked victims into downloading malware that silently replaces browser wallet extensions and steals the wallet password when it’s typed. The same reporting also describes invoice emails using QR codes to push…
Researchers observed a real phishing campaign that abused Microsoft 365’s Direct Send feature to make emails look like they came from the victim organization’s own domain, without compromising an employee account. The campaign was timed to mimic human sending patterns during U.S. Eastern business…
This weekly threat bulletin describes real incidents where attackers used human manipulation to break in, including social engineering at Levi Strauss and a Microsoft 365 credential-theft phish at defense supplier IEH. It also highlights a Lazarus-linked campaign using fake job offers and…
Researchers tied North Korea’s Lazarus Group to a real-world campaign that approaches professionals with convincing fake recruiter outreach and job offers. Victims are tricked into opening a malicious PDF or installing a fake PDF viewer from lookalike websites, which then installs backdoors and can…
Researchers observed a real phishing campaign that abused Microsoft 365’s “Direct Send” feature to deliver messages that looked like they came from trusted internal addresses (HR, accounting, admin). The emails commonly used familiar business lures like invoices, payment approvals, voicemail…
This roundup describes real-world social engineering where attackers impersonate recruiters on LinkedIn and lure developers into running “coding tests” that install malware. It also outlines active phishing campaigns that abuse trusted cloud services (Google, AWS, Azure, Cloudflare) to send…
