GhostCode phishing kit hijacks Microsoft 365 accounts by tricking users into approving malicious device-code logins.