New Phishing Kits 'Jalisco' and 'OmegaLord' Bypass MFA on Microsoft 365 Accounts via OAuth Device Code Abuse and Fake PDF-Reader Credential Harvesting
New Phishing Kits 'Jalisco' and 'OmegaLord' Bypass MFA on (TL-2026-1306), also tracked as Jalisco Phishing Kit, is a high-severity phishing campaign, first published 2026-07-14. It has no confirmed attribution, affects Microsoft Microsoft 365 / Entra ID (Azure AD), maps to 16 MITRE ATT&CK techniques (T1056, T1090, T1098), and is covered by 9 detection rules and 25 indicators of compromise.
Key facts for TL-2026-1306
- Threat ID
- TL-2026-1306
- Also known as
- Jalisco Phishing Kit, OmegaLord Phishing Kit, Device Code Phishing
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- 2026-07-14
- Last reviewed
- 2026-07-14
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- construction, nonprofit, real-estate, manufacturing, financial-services, health, legal, government administration, enterprise-saas-tenants
- Target regions
- North America, Europe, Oceania, Middle East, Asia
- Detection rules
- 9
- Indicators of compromise
- 25
Malware and tooling in New Phishing Kits 'Jalisco' and 'OmegaLord' Bypass MFA on
Malware and tooling: EvilTokens, Forg365, Jalisco, Kali365, OmegaLord, Tycoon2FA, Venom
Two newly documented phishing kits, Jalisco and OmegaLord, target Microsoft 365, Entra ID, and SharePoint accounts with techniques designed to bypass multi-factor authentication. Jalisco abuses the OAuth 2.0 Device Authorization Grant flow, auto-generating fresh Microsoft device codes to defeat the 15-minute validity window, while OmegaLord masquerades as a PDF-reader login to harvest credentials and phone numbers used for MFA interception.
How New Phishing Kits 'Jalisco' and 'OmegaLord' Bypass MFA on works
ReliaQuest researchers documented two active phishing kits being used against Microsoft 365, Entra ID, and SharePoint tenants: Jalisco and OmegaLord. Jalisco is a device-code phishing toolkit that exploits the OAuth 2.0 Device Authorization Grant flow, a legitimate mechanism intended for input-constrained devices (smart TVs, IoT, CLI tools) that generates a short-lived, human-readable device code a user enters on a Microsoft login page to authorize a session. Attackers initiate the device-code sign-in flow themselves, then use social engineering (fake meeting invites, IT-support pretexts, quishing) to convince a victim to enter the code on the legitimate microsoft.com/devicelogin (or equivalent) page. Because approving the code silently grants the attacker's client an OAuth token, no password or interactive MFA challenge is ever presented to the attacker. Microsoft's mitigation for this abuse pattern is a 15-minute code validity window; Jalisco defeats that control by automatically regenerating fresh device codes on a rolling basis, giving the operator effectively unlimited time to socially engineer a victim into approving a code, and includes an operator-facing web portal for session tracking and account management. OmegaLord takes a different but complementary approach: it presents victims with a spoofed PDF Reader login interface designed to harvest email addresses, passwords, and phone numbers. The explicit collection of phone numbers is notable because it directly targets the credential most commonly used to intercept, redirect, or socially engineer around SMS/voice-based MFA challenges, effectively pairing password theft with a follow-on MFA-interception capability rather than relying on MFA fatigue alone. Once inside a tenant, ReliaQuest observed operators registering multiple rogue devices per compromised account (as many as five), naming them with benign strings containing 'Microsoft' or 'Windows' to blend in with legitimate device inventory, and exfiltrating SharePoint contents, PII, financial records, and internal communications within as little as six minutes of initial compromise -- a window that leaves minimal room for manual SOC triage before data loss occurs. Jalisco and OmegaLord join a broader 2026 wave of OAuth device-code phishing-as-a-service (PhaaS) offerings -- including EvilTokens, Kali365, Tycoon2FA, Venom, and Forg365 -- all of which weaponize the same underlying device-code and adversary-in-the-middle (AitM) session-theft techniques against Microsoft 365/Entra ID identities at scale. A related, broader device-code campaign tracked separately by other researchers (attributed in part to activity clusters Storm-2372, APT29, UTA0304, UTA0307, and UNK_AcademicFlare) compromised 340+ organizations across construction, nonprofit, real estate, manufacturing, financial services, healthcare, legal, and government sectors in the US, Canada, Australia, New Zealand, and Germany, using Railway PaaS-hosted credential-harvesting infrastructure, Cloudflare Workers and Vercel as redirect intermediaries, abused legitimate Cisco/Trend Micro/Mimecast redirect services to bypass spam filters, and residential proxy infrastructure geo-matched to each victim's city to make sign-ins appear normal. Because the technique authorizes a real, unmodified Microsoft login flow, it evades traditional credential-phishing detections that look for spoofed login pages, fake domains, or password-field harvesting, and the resulting OAuth refresh tokens remain valid even after a victim's password is reset, requiring explicit token revocation for remediation.
MITRE ATT&CK techniques used in TL-2026-1306
Credential Access
T1056 Input Capture; T1110 Brute Force; T1528 Steal Application Access Token; T1621 Multi-Factor Authentication Request Generation
Command and Control
T1090 Proxy; T1102 Web Service
Persistence
Execution
Collection
T1213 Data from Information Repositories
Discovery
lateral-movement
T1550 Use Alternate Authentication Material
Initial Access
Exfiltration
T1567 Exfiltration Over Web Service
Resource Development
T1583 Acquire Infrastructure; T1584 Compromise Infrastructure
Reconnaissance
Affected products and versions in New Phishing Kits 'Jalisco' and 'OmegaLord' Bypass MFA on
- Microsoft — Microsoft 365 / Entra ID (Azure AD)
Vulnerable versions: All tenants with OAuth 2.0 Device Authorization Grant enabled - Microsoft — SharePoint Online
Vulnerable versions: All tenants accessible via compromised Microsoft 365 identity - Okta — Okta OAuth Authorization Server
Vulnerable versions: Deployments with Device Authorization grant type enabled and unrestricted
Remediation for New Phishing Kits 'Jalisco' and 'OmegaLord' Bypass MFA on
Immediate actions
- Disable or restrict OAuth 2.0 Device Authorization Grant (device code flow) via Entra ID Conditional Access policies where it is not operationally required
- Reduce the Entra ID per-user device-registration limit from the default of 50 down to 1-2 to blunt rogue-device persistence
- Scan Entra ID and Microsoft 365 sign-in logs for device-code grant events, especially those followed by new device or new MFA-method registrations within minutes
- Revoke refresh/access tokens and force re-authentication for any account with suspicious device-code sign-ins or newly registered devices named with 'Microsoft'/'Windows' strings
- Block sign-ins and known redirector traffic from identified hosting/proxy infrastructure abused for device-code phishing (Railway PaaS IP ranges, unsanctioned Cloudflare Workers/Vercel redirector domains)
Workarounds
- Where device code flow cannot be fully disabled, restrict it via Conditional Access to only trusted named locations/networks
- In Okta or non-Microsoft IdPs exposed to similar risk, explicitly restrict the OAuth Device Authorization grant type at the authorization-server policy level
Longer-term hardening
- Restrict sensitive SaaS access (SharePoint, Exchange Online, Teams) to managed/compliant endpoints via Conditional Access device-compliance requirements
- Move MFA away from SMS/voice-based factors toward phishing-resistant methods (FIDO2/WebAuthn security keys, certificate-based authentication) to remove the phone-number-interception attack surface OmegaLord targets
- Deploy identity threat detection and response (ITDR) tooling tuned to device-code and OAuth consent-grant abuse patterns
- Audit and periodically re-certify third-party and first-party app registrations/OAuth consent grants tenant-wide
- Block newly registered / low-reputation domains proactively at the email and web gateway before they are weaponized as device-code lure infrastructure
Weaknesses (CWE) in New Phishing Kits 'Jalisco' and 'OmegaLord' Bypass MFA on
CWE-287, CWE-290, CWE-451
Timeline of New Phishing Kits 'Jalisco' and 'OmegaLord' Bypass MFA on
- EvilTokens, a Microsoft device-code phishing kit sold as a phishing-as-a-service platform with 24/7 Telegram support, launches, offering impersonation templates, code generation, and AI-powered automation to buyers.
- A large-scale OAuth device-code phishing campaign targeting Microsoft 365 identities across 340+ organizations in the US, Canada, Australia, New Zealand, and Germany is first observed active.
- The 340+ organization device-code phishing campaign is publicly disclosed, detailing Railway PaaS infrastructure, Cloudflare Workers/Vercel redirectors, and abuse of legitimate security-vendor redirect services.
- Reporting indicates hundreds of Microsoft 365 accounts are being compromised daily via device-code phishing techniques.
- The FBI's Internet Crime Complaint Center (IC3) issues a public service announcement on the Kali365 phishing-as-a-service kit hijacking Microsoft 365 access tokens via device-code abuse.
- Forg365, another phishing-as-a-service kit combining device-code phishing with adversary-in-the-middle session theft, is disclosed as actively targeting Microsoft 365 tenants.
- Attackers begin exfiltrating SharePoint contents, PII, financial records, and internal communications in as little as six minutes after initial account compromise.
- Operators observed registering up to five rogue devices per compromised account, using names containing 'Microsoft' or 'Windows' to blend in with legitimate device inventory.
- ReliaQuest researchers document Jalisco and OmegaLord, two new phishing kits targeting Microsoft 365/Entra ID/SharePoint with automated device-code regeneration and PDF-reader-lure phone-number harvesting for MFA interception; findings published via BleepingComputer.
Sources cited for New Phishing Kits 'Jalisco' and 'OmegaLord' Bypass MFA on
- New phishing kits target Microsoft 365 accounts, evade MFA
- Microsoft 365 device code phishing campaign bypasses password stealing
- Microsoft 365 Device Code Phishing Campaign Bypasses Password Theft With Legitimate Login Flow
- Device Code Phishing Hits 340+ Microsoft 365 Orgs Across Five Countries via OAuth Abuse
- Hundreds compromised daily in Microsoft device code phishes
- Kali365 Phishing-as-a-Service Kit Hijacks Microsoft 365 Access Tokens
- Forg365 PhaaS Targets Microsoft 365 with Device Code and AitM Session Theft
- Steal Application Access Token, Technique T1528 - Enterprise | MITRE ATT&CK
Threats related to New Phishing Kits 'Jalisco' and 'OmegaLord' Bypass MFA on
- Microsoft Entra ID Device Code Phishing — OAuth 2.0 Device Authorization Grant Abuse (Storm-2372, EvilTokens, Kali365)
- Device Code Phishing Surge — 37x Increase Driven by EvilTokens and VENOM PhaaS Kits Targeting Microsoft 365
- EvilTokens Phishing-as-a-Service Kit Abuses Microsoft Device Code Authentication with AES-GCM "Ghost Code" to Breach Finance, Tech, and Managed Security Firms
- EvilTokens Phishing-as-a-Service: Microsoft OAuth 2.0 Device Authorization Grant (Device Code) Phishing Against Microsoft 365
- Microsoft 365 Device Code Phishing Campaign Abusing the OAuth 2.0 Device Authorization Grant Flow (EvilTokens PhaaS)
- ARToken Phishing Panel Abuses Microsoft OAuth Device Code Flow to Hijack Microsoft 365 Accounts (EvilTokens PhaaS)
Detection coverage for TL-2026-1306
As of 2026-07-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1306 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.