#ParsedReport #CompletenessMedium
17-09-2026

GhostCode: Dissecting a Novel Device Code Phishing Kit

https://www.esentire.com/blog/ghostcode-dissecting-a-novel-device-code-phishing-kit

Report completeness: Medium

Threats:
Device_code_phishing_technique
Eviltokens_tool
Residential_proxy_technique

Victims:
Service providers, Distributors, Manufacturers, Warehousing companies, Healthcare clinic

Industry:
Iot

Geo:
Germany, United kingdom, England, Ireland, London

ChatGPT TTPs:
do not use without manual check
T1027, T1027.013, T1059.007, T1090.002, T1098.005, T1114, T1140, T1204.002, T1528, T1550.001, have more...

IOCs:
Domain: 70
Email: 1
File: 3
Url: 1
IP: 9

Soft:
Salesforce, WeTransfer, Cloudflare Turnstile, curl, selenium, phantomjs, Outlook, Microsoft Outlook, Azure AD, Active Directory, have more...

Algorithms:
gzip, aes-gcm, deflate, aes, aes-256-gcm

Functions:
Service

Languages:
javascript, python

Links:
https://github.com/eSentire/iocs/blob/main/GhostCode/GhostCode-iocs-09-09-2026.txt