OTX Threat: GhostCode: Dissecting a Novel Device Code Phishing Kit

In late August 2026, a sophisticated device code phishing campaign was identified, distributed through web contact forms. Threat actors impersonated procurement officers from legitimate businesses, specifically BJ's Wholesale Club, using lookalike domains registered with Zoho Mail. The campaign, tracked as GhostCode, abused Microsoft's OAuth 2.0 device authorization grant flow to obtain authentica CVEs: CVE-2026-81578, CVE-2026-82078, CVE-2026-86218