Researchers observed a real phishing campaign using a kit called GhostCode that abuses Microsoft’s legitimate “device code” sign-in flow to steal authentication tokens. Victims are socially engineered to open an NDA-themed HTML file and then enter a device code on Microsoft’s login page, unintentionally authorizing an attacker-controlled device. The stolen tokens are then used to register devices and maintain persistent access to the victim’s Microsoft 365 environment.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get a legit-looking procurement inquiry on your website, then an NDA to review. Normal day, right? But this is GhostCode. That HTML NDA quietly sends you to a Microsoft page asking you to enter a device code to view the document. You sign in and pass MFA like normal, but here’s the twist: you just approved an attacker-controlled device. They grab your tokens, register devices, even enroll one into Intune that can survive token revocation. Aha moment: NDAs do not need a device code. If you’re ever told to enter a Microsoft device code just to open a document, stop and call IT before you touch it.
Microsoft reports that the EvilTokens phishing-as-a-service platform helped criminals compromise thousands of organizations by tricking users into completing a legitimate Microsoft “device code” login. The lure drives victims to enter a short code at microsoft.com/devicelogin, which unknowingly…
Researchers observed real campaigns where a fake “AI crypto trading agent” website tricked victims into downloading malware that silently replaces browser wallet extensions and steals the wallet password when it’s typed. The same reporting also describes invoice emails using QR codes to push…
Researchers observed a real phishing campaign that abused Microsoft 365’s Direct Send feature to make emails look like they came from the victim organization’s own domain, without compromising an employee account. The campaign was timed to mimic human sending patterns during U.S. Eastern business…
Iran-aligned DarkBlinders used convincing recruitment offers while posing as Dubai Airports recruiters to target a high-value job seeker in Iraq. The victim was asked to complete what appeared to be a coding assessment, but the assessment package installed malware. The group also used lookalike…
Microsoft reports that North Korean threat actors are using AI to make job scams, fake recruiter outreach, fraudulent worker identities, and targeted phishing campaigns faster and more convincing. One group posed as recruiters for a spoofed AI blockchain company and scheduled software-engineer…
This weekly recap highlights multiple real-world campaigns where attackers trick users into taking actions that grant access, without needing to steal passwords directly. Notable examples include “device code” phishing (victims are instructed to enter a short code to approve an attacker session)…
