eSentire Uncovers GhostCode Phishing Kit Exploiting Microsoft OAuth for Account Takeover

En bref

• eSentire identified a phishing kit called GhostCode that abuses Microsoft OAuth.
• Attackers bypass multi-factor authentication, steal tokens, and enroll their own devices.
• Victims' Microsoft 365 accounts can be accessed and hijacked without exploiting a software vulnerability.
• The campaign carries a medium severity rating with no associated CVEs.

Security researchers at eSentire have exposed a phishing kit dubbed GhostCode. The operators behind this kit exploit Microsoft's OAuth authorization mechanism. By doing so, they can obtain authentication tokens, enroll their own hardware into targeted tenants, and then reach victim accounts. This chain results in account takeover and illicit entry without needing to crack passwords.

Those at risk are organizations using Microsoft 365 and its identity services. The attack circumvents multi-factor authentication by leveraging stolen session tokens. Once a token is captured, the attacker can impersonate the user, bypassing additional verification. The enrollment of a new device gives the intruder a durable foothold, enabling unauthorized access even after a password reset.

Because no CVE is linked to this campaign, patching software alone will not mitigate the threat. The abuse relies on legitimate OAuth flows, making detection challenging. eSentire's discovery underscores a broader trend: attackers increasingly target identity layers rather than operating system flaws. The medium severity rating reflects that while the technique is effective, it requires user interaction or prior token compromise.

To defend against such schemes, administrators should monitor for unusual device registrations and token issuance patterns. Conditional access policies that require compliant devices or trusted locations can help. Reviewing OAuth application consents and auditing sign-in logs for anomalies are also critical. Since the GhostCode kit is phishing-based, user awareness training remains valuable, but technical controls around token lifetime and device trust are paramount.

What to watch: spikes in new device enrollments, impossible travel events, or token replay attempts. If an account is hijacked, revoke refresh tokens and remove unknown devices immediately. eSentire's report highlights that even medium-severity threats can lead to full tenant compromise if left unchecked.

À faire maintenant

1. Enforce conditional access policies that block token replay and require compliant or trusted devices.
2. Audit and restrict OAuth app permissions; disable user consent for third-party applications.
3. Monitor sign-in logs for anomalous token issuance, impossible travel, and new device registrations.
4. Implement short token lifetimes and require re-authentication for sensitive actions.
5. Educate users on phishing that targets OAuth consent screens and device registration prompts.
6. If compromise is suspected, revoke refresh tokens and remove unauthorized devices immediately.
7. Enable Microsoft Defender for Cloud Apps or similar tools to detect suspicious OAuth activity.

Source originale

Hackread