IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Your Exposure
TLP:WHITE2 IOCs

GhostCode Abuses Microsoft Device Codes to Steal M365 Tokens and Register Rogue Devices

CP
Cyber Press
Published September 16, 2026Original Report

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYunknownINFRASTRUCTUREflashproxy.iobjssourcing.comCAPABILITYunknownVICTIMunknown
Adversary
Infrastructure(2)
Capability
Victim

Indicators of Compromise

Indicators of Compromise2

TypeIndicatorConfidenceScoreFirst Seen
Domainflashproxy.io
intel-blognetworkproxy
High
58
Sep 16, 26
Domainbjssourcing.com
exploitintel-blognetwork
High
58
Sep 16, 26

IOC Relationship Graph

IOC Relationship Graph2 total IOCs
Domain
Domain2REPORTGhostCode Abuses Microsoft
scroll to zoom · drag to pan · click IOC to open