GhostCode Phishing Kit Exploits Microsoft OAuth to Hijack M365 Accounts in Under 80 Seconds In late August 2026, eSentire’s Threat Response Unit (TRU) uncovered GhostCode, a previously undocumented phishing kit that abuses Microsoft’s OAuth 2.0 device authorization flow to compromise M365 accounts. The attack begins with social engineering, not malware, as threat actors impersonate procurement officers most notably using a lookalike domain (bjssourcing[.]com) to pose as BJ’s Wholesale Club. Over 30 similar domains were registered in August 2026, targeting distributors, manufacturers, and warehousing firms in a broader business email compromise (BEC) campaign. After luring victims through a Salesforce contact form, attackers follow up with a fake NDA pretext, directing targets to a password-protected HTML file hosted on WeTransfer. The file, disguised as a "FlipBook" document viewer, employs multiple evasion tactics: junk padding to inflate file size, HTML comment injection to bypass phishing classifiers, and AES-256-GCM encryption to conceal the final redirect URL until the victim enters a password. Once decrypted, the link passes through bot-filtering challenges and Cloudflare Turnstile before reaching an AI-generated phishing page on a compromised chiropractic clinic’s subdomain. The kit impersonates Microsoft’s Authentication Broker app, generating a device code that victims unknowingly authorize on Microsoft’s legitimate login portal. To evade detection, GhostCode uses geolocation APIs and residential proxies (including FlashProxy[.]io) to match the victim’s country, bypassing Conditional Access "impossible travel" alerts. Within five seconds of MFA completion, attackers begin token abuse, registering three Azure AD devices, enrolling one in Intune, and obtaining a Primary Refresh Token (PRT) that grants persistent, SSO-equivalent access to the entire M365 tenant for up to 14 days even after token revocation. The attack executes in just 78 seconds, with traffic routed through rotating UK residential IPs and a German IP tied to ASN 12586 (GHOSTnet GmbH), which inspired the kit’s name. Notably, MFA offers no protection, as the stolen PRT retains the MFA claim. eSentire’s research highlights that enrolled Intune devices persist post-compromise, and defenders are advised to monitor for rapid device registrations tied to python-requests user agents within a single sign-in session. A KQL hunting query has been published to detect similar intrusions.

Malware Distribution Platform Exposed Due to Critical Security Misconfiguration A cybersecurity researcher recently uncovered a live malware distribution platform after discovering an exposed PHP installation page a basic operational security failure that granted full administrative access to the threat actor’s backend infrastructure. The investigation began when a researcher on X (formerly Twitter) identified a suspicious domain linked to a fake software download portal, a common tactic in SEO poisoning campaigns designed to manipulate search rankings and redirect victims to malware-laden downloads. Using the directory-bruteforcing tool ffuf, the researcher identified sensitive endpoints, including `/admin/login.php` and `/config/database.php`. The most critical oversight was the presence of a live `/install/install.php` page on a production server a textbook security misconfiguration where deployment steps are left incomplete. The researcher tested the application’s reinstallation safeguards and found none. By spinning up a Docker-hosted MySQL instance via ngrok and submitting controlled database credentials, they bypassed the setup process entirely, creating a new administrator account and redirecting the application’s database to their own infrastructure. After a brief 500 Internal Server Error likely caused by the database conflict the threat actor restored the application, but the researcher’s session remained active. Since the PHP application stored session state server-side rather than in the database, the backend reconfiguration did not invalidate existing sessions. This allowed full access to the administrative dashboard, which displayed panels in Russian for managing keywords, visitor tracking, downloads, and payload configurations key components of an SEO-driven malware distribution operation. The backend, built on a PHP/MySQL stack, dynamically generated download pages based on URL parameters. Victims were funneled through intermediate redirectors, including Google Colab pages, before reaching the final payload a compressed archive containing malware. This layered redirect chain is a known tactic to obscure the true hosting infrastructure from users and security scanners. The incident aligns with a broader trend of threat actor OPSEC failures, including cases documented by Vectra AI in December 2025, where groups like Devman ransomware and North Korea’s Lazarus Group exposed internal infrastructure due to rushed deployments and inadequate hardening. Indicators of Compromise (IOCs): - Domains: `micronsoftwares[.]com`, `wetransfer[.]icu` - SHA256: `7b03fb383a5ce784a3cb9b0f8a76a84e984d14e553de5d98faff3d07d9793085` (payload.exe) The threat actor patched the initialization flaw shortly after the breach, but the brief exposure provided rare insight into the mechanics of an active malware distribution operation. At the time of reporting, the domains remained active.