GhostCode: Dissecting a Novel Device Code Phishing Kit

GhostCode is a highly evasive phishing kit that abuses Microsoft’s device code authorization flow—bypassing MFA and rapidly establishing persistent access to victim accounts—by tricking users into authenticating attacker-controlled devices through convincing business email lures and layered obfuscation.