GhostCode Cloudflare Turnstile Gate Before Device Code Phish

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•5

This rule set detects web traffic associated with 'GhostCode' phishing campaigns. These campaigns utilize Cloudflare Turnstile verification gates on non-Cloudflare domains, specific phishing page titles, and session cookies ('turnstile_verified', 'cf_clearance') to facilitate device code phishing or credential harvesting activities.