GhostCode phishing used business outreach and contact forms to abuse Microsoft device codes, steal tokens, and get a Primary Refresh Token in under 78 seconds, using obfuscation, proxy rotation, and trusted services. #GhostCode #Storm2372