GhostCode attackers hijack Microsoft 365 accounts with device codes

GhostCode attackers abuse device codes to hijack Microsoft 365 accounts
A new phishing kit abuses a legitimate Microsoft device authorization flow intended for use with printers or smart TVs to steal authentication tokens, register attacker-controlled devices and gain persistent access to a victim’s Microsoft 365 environments.
By: computerworld.com








