Executive Summary

A new phishing kit, GhostCode, is being used to target Microsoft 365 users by exploiting a weakness in Microsoft's OAuth 2.0 device authorization grant flow. This campaign uses social-engineering tactics to convince victims to enter a device code on Microsoft's authentication page, allowing attackers to obtain authentication tokens and establish persistence in the victim's Microsoft environment. The severity level of this threat is high, as it can lead to account takeovers and unauthorized access to sensitive information.

Technical Analysis

The GhostCode phishing kit abuses Microsoft's OAuth 2.0 device authorization grant flow, a legitimate mechanism designed to enable authentication from IoT devices, smart TVs, printers, or other devices that cannot easily support a conventional browser-based login. The technique, known as device-code phishing, has been seen in other attacks before. GhostCode poses as a device, gets Microsoft's OAuth to generate a device code, and then convinces the victim to enter it on Microsoft's authentication page. The victim then signs in and completes multifactor authentication as normal — but the authentication is for the attacker-controlled device, allowing them to obtain the resulting authentication tokens.

How It Gets Exploited

An attacker uses a social-engineering setup to pose as a procurement officer through a web contact form, then moves conversations to an NDA-themed HTML file. Opening the file takes the victim to the device-code phishing page. The victim enters the device code on Microsoft's authentication page, completing multifactor authentication as normal. However, the authentication is for the attacker-controlled device, allowing them to obtain the resulting authentication tokens. These tokens are then used to register attacker-controlled devices, obtain additional credentials, and establish persistence in the victim's Microsoft environment. Specifically, eSentire recorded nine successful API calls over a 78-second period, involving Microsoft Intune Enrollment, the Device Registration Service, Azure Active Directory, and Microsoft Graph.

Impact Assessment

Microsoft 365 users are affected by this campaign. The attackers can achieve persistence in the victim's Microsoft environment, allowing them to access sensitive information and potentially move laterally within the organization. The blast radius of this threat is significant, as it can lead to account takeovers and unauthorized access to sensitive information.

Recommended Actions

  • Educate users on the dangers of device-code phishing and the importance of verifying the authenticity of requests for device codes.
  • Implement additional security measures, such as conditional access policies and multifactor authentication, to make it more difficult for attackers to use stolen authentication tokens.
  • Monitor for suspicious activity, such as unusual API calls or device registrations, and investigate promptly.
  • Consider implementing a Web Application Firewall (WAF) to detect and block suspicious traffic.

Sources

  • CSO Online: GhostCode attackers abuse device codes to take over Microsoft 365 accounts