Threat Analysis: GhostCode Device Code Phishing and ScreenConnect Exploitation, What UK SMBs Need to Know
This is your Daily Threat Analysis for the 16th of September 2026.
Two items today. Both in active use. Neither of them theoretical. I will take them in priority order.
ScreenConnect: CISA Confirms Active Exploitation, This Is Your MSP’s Problem, Which Makes It Yours
CISA has added a critical ConnectWise ScreenConnect vulnerability to its Known Exploited Vulnerabilities catalogue. That designation means CISA has confirmed, with evidence, that this flaw is being exploited in the wild right now. It is not a risk score on a spreadsheet. Somebody is using it.
ScreenConnect is a remote desktop and support tool. It is the software your IT provider or managed service provider likely uses to access your systems when you raise a support ticket. That access, the legitimate kind, is exactly what makes this class of vulnerability so consequential for SMBs. You are not the primary target. Your MSP is. But if your MSP’s ScreenConnect installation is unpatched and an attacker gets in, the attacker has the same access to your systems that your IT provider does.
The advisory does not spell that out in those terms. It says organisations should patch. What it does not say is that the majority of UK SMBs do not manage ScreenConnect themselves, their IT providers do, which means the patch status of this tool is almost certainly not something you have visibility of, and may not be something your IT provider has communicated to you.
The question to ask your IT provider today is direct: are you running a patched version of ConnectWise ScreenConnect, and can you confirm that in writing? If they cannot answer promptly and specifically, that tells you something worth knowing.
This is not the first time a remote management tool has become an attack vector against SMB supply chains. The pattern is consistent: attackers target the infrastructure that serves many small businesses rather than attacking each one individually. The leverage is obvious. One compromised MSP toolset is access to dozens or hundreds of client environments.
GhostCode: OAuth Device Phishing That Bypasses Your Spam Filter and Requires No Password
The second item requires a bit more explanation because the technique is less familiar to most people outside a security operations context.
eSentire’s research team published detailed analysis of a phishing kit they have named GhostCode, observed in active campaigns in late August 2026. The campaign targets businesses, specifically, it has been impersonating procurement officers from legitimate companies, using lookalike domains registered through Zoho Mail, and initiating contact through web contact forms rather than unsolicited email.
That last detail matters. Web contact forms are, by definition, messages your organisation has invited. Spam filters are not well-positioned to intercept them. The message arrives in someone’s inbox looking like a legitimate business enquiry.
The technical mechanism is what makes GhostCode distinct. Rather than directing victims to a fake login page that harvests credentials, GhostCode abuses Microsoft’s OAuth 2.0 device authorisation grant flow. This is a legitimate Microsoft feature, designed to allow authentication on devices without a browser, think smart TVs, printers, that sort of thing. The flow works like this: a device displays a code and asks the user to visit a Microsoft URL and enter it. When they do, the device receives an authentication token.
GhostCode weaponises this by generating a device code and presenting it to the victim as part of what appears to be a legitimate business process, a document to review, a procurement portal to access, something contextually plausible. The victim visits the genuine Microsoft URL, enters the genuine code, and authenticates. The attacker, who generated the code, receives the resulting access token.
No fake login page. No password harvested. No obvious red flags in the Microsoft authentication flow itself, because that part is real. The attacker ends up with persistent access to the victim’s Microsoft 365 account, email, SharePoint, Teams, OneDrive, potentially without the victim ever realising anything unusual occurred.
The campaign is using residential proxy infrastructure to route traffic, which makes network-level detection harder. The 54 indicators of compromise published alongside the eSentire report are the practical starting point for defenders.
The NCSC has published guidance on OAuth abuse and on protecting Microsoft 365 environments. The fact that device code phishing has been documented as a technique since at least 2021 and campaigns like GhostCode continue to operate successfully tells you everything you need to know about how organisations are applying that guidance.
A Third Item Worth Noting: Pixel Zero-Day
Briefly, because it is relevant to businesses where staff use Android devices for work: Google has released September 2026 patches for Pixel devices addressing 110 vulnerabilities, including one zero-day confirmed as actively exploited in targeted attacks. The zero-day involves privilege escalation. If your organisation uses Pixel devices for work, ensure automatic updates are enabled or push the patch through your MDM solution. This one appears to have been used in targeted rather than opportunistic attacks, but the patch is available and there is no reason to delay.
What to Do Today
For ScreenConnect: contact your IT provider and ask, specifically, whether ConnectWise ScreenConnect in your environment is running the patched version. Get a written response. If they cannot tell you, escalate.
For GhostCode: brief anyone who handles your organisation’s web enquiries or procurement contacts. The tell is being asked to enter a code on a Microsoft website as part of what appears to be a routine business process. Legitimate counterparties do not initiate contact this way. If a web enquiry asks your staff to authenticate anywhere, even to a real Microsoft page, that should prompt a phone call to verify the sender through a separate channel before proceeding.
For Microsoft 365 tenants specifically: review your OAuth app consents. In the Microsoft Entra admin centre, under Enterprise Applications, you can see what third-party applications have been granted access to your tenant. Anything unrecognised should be revoked. Conditional access policies that restrict which apps can use device code flow are also worth discussing with your IT provider.
The pattern today is not unusual. Two distinct attack vectors, both targeting businesses through their legitimate infrastructure and their legitimate processes. That is the point. Attacks that look like normal business operations are the ones that succeed.
If Threat Analysis is useful to you, follow the show wherever you listen so tomorrow’s briefing lands automatically, and pass it to someone who needs the heads-up. A five-second forward to the right person is worth more than any advisory.
Sources
| Source | Title | URL |
|---|---|---|
| CISA KEV | Known Exploited Vulnerabilities Catalog, ConnectWise ScreenConnect | https://www.cisa.gov/known-exploited-vulnerabilities-catalog |
| BleepingComputer | Critical ScreenConnect flaw now actively exploited in attacks | https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-critical-screenconnect-flaw/ |
| eSentire | GhostCode: Dissecting a Novel Device Code Phishing Kit | https://www.esentire.com/blog/ghostcode-dissecting-a-novel-device-code-phishing-kit |
| AlienVault OTX | GhostCode Threat Pulse, 54 indicators of compromise | https://otx.alienvault.com |
| BleepingComputer | Google fixes actively exploited Android zero-day on Pixel devices | https://www.bleepingcomputer.com/news/security/google-fixes-actively-exploited-android-zero-day-on-pixel-devices/ |
| Cisco Talos | Securing the unpatchable in an age of AI-driven vulnerabilities | https://blog.talosintelligence.com/securing-the-unpatchable-in-an-age-of-ai-driven-vulnerabilities/ |