# New Phishing Kits 'Jalisco' and 'OmegaLord' Bypass MFA on Microsoft 365 Accounts via OAuth Device Code Abuse and Fake PDF-Reader Credential Harvesting

> Two newly documented phishing kits, Jalisco and OmegaLord, target Microsoft 365, Entra ID, and SharePoint accounts with techniques designed to bypass multi-factor authentication. Jalisco abuses the OAuth 2.0 Device Authorization Grant flow, auto-generating fresh Microsoft device codes to defeat the 15-minute validity window, while OmegaLord masquerades as a PDF-reader login to harvest credentials and phone numbers used for MFA interception.

- **Published:** 2026-07-14T00:00:00Z
- **Last reviewed:** 2026-07-14T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1306
- **ID:** TL-2026-1306
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 25 (full data via the Threadlinqs MCP server — Purple tier)

## Description

ReliaQuest researchers documented two active phishing kits being used against Microsoft 365, Entra ID, and SharePoint tenants: Jalisco and OmegaLord. Jalisco is a device-code phishing toolkit that exploits the OAuth 2.0 Device Authorization Grant flow, a legitimate mechanism intended for input-constrained devices (smart TVs, IoT, CLI tools) that generates a short-lived, human-readable device code a user enters on a Microsoft login page to authorize a session. Attackers initiate the device-code sign-in flow themselves, then use social engineering (fake meeting invites, IT-support pretexts, quishing) to convince a victim to enter the code on the legitimate microsoft.com/devicelogin (or equivalent) page. Because approving the code silently grants the attacker's client an OAuth token, no password or interactive MFA challenge is ever presented to the attacker. Microsoft's mitigation for this abuse pattern is a 15-minute code validity window; Jalisco defeats that control by automatically regenerating fresh device codes on a rolling basis, giving the operator effectively unlimited time to socially engineer a victim into approving a code, and includes an operator-facing web portal for session tracking and account management. OmegaLord takes a different but complementary approach: it presents victims with a spoofed PDF Reader login interface designed to harvest email addresses, passwords, and phone numbers. The explicit collection of phone numbers is notable because it directly targets the credential most commonly used to intercept, redirect, or socially engineer around SMS/voice-based MFA challenges, effectively pairing password theft with a follow-on MFA-interception capability rather than relying on MFA fatigue alone. Once inside a tenant, ReliaQuest observed operators registering multiple rogue devices per compromised account (as many as five), naming them with benign strings containing 'Microsoft' or 'Windows' to blend in with legitimate device inventory, and exfiltrating SharePoint contents, PII, financial records, and internal communications within as little as six minutes of initial compromise -- a window that leaves minimal room for manual SOC triage before data loss occurs. Jalisco and OmegaLord join a broader 2026 wave of OAuth device-code phishing-as-a-service (PhaaS) offerings -- including EvilTokens, Kali365, Tycoon2FA, Venom, and Forg365 -- all of which weaponize the same underlying device-code and adversary-in-the-middle (AitM) session-theft techniques against Microsoft 365/Entra ID identities at scale. A related, broader device-code campaign tracked separately by other researchers (attributed in part to activity clusters Storm-2372, APT29, UTA0304, UTA0307, and UNK_AcademicFlare) compromised 340+ organizations across construction, nonprofit, real estate, manufacturing, financial services, healthcare, legal, and government sectors in the US, Canada, Australia, New Zealand, and Germany, using Railway PaaS-hosted credential-harvesting infrastructure, Cloudflare Workers and Vercel as redirect intermediaries, abused legitimate Cisco/Trend Micro/Mimecast redirect services to bypass spam filters, and residential proxy infrastructure geo-matched to each victim's city to make sign-ins appear normal. Because the technique authorizes a real, unmodified Microsoft login flow, it evades traditional credential-phishing detections that look for spoofed login pages, fake domains, or password-field harvesting, and the resulting OAuth refresh tokens remain valid even after a victim's password is reset, requiring explicit token revocation for remediation.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1583 Acquire Infrastructure
- T1584 Compromise Infrastructure
- T1566 Phishing
- T1204 User Execution
- T1098 Account Manipulation
- T1550 Use Alternate Authentication Material
- T1528 Steal Application Access Token
- T1621 Multi-Factor Authentication Request Generation
- T1056 Input Capture
- T1110 Brute Force
- T1526 Cloud Service Discovery
- T1213 Data from Information Repositories
- T1090 Proxy
- T1102 Web Service
- T1567 Exfiltration Over Web Service

## Sources

- [New phishing kits target Microsoft 365 accounts, evade MFA](https://www.bleepingcomputer.com/news/security/new-phishing-kits-target-microsoft-365-accounts-evade-mfa/)
- [Microsoft 365 device code phishing campaign bypasses password stealing](https://www.reversinglabs.com/blog/device-code-phishing-campaign)
- [Microsoft 365 Device Code Phishing Campaign Bypasses Password Theft With Legitimate Login Flow](https://cybersecuritynews.com/microsoft-365-device-code-phishing-campaign/)
- [Device Code Phishing Hits 340+ Microsoft 365 Orgs Across Five Countries via OAuth Abuse](https://thehackernews.com/2026/03/device-code-phishing-hits-340-microsoft.html)
- [Hundreds compromised daily in Microsoft device code phishes](https://www.theregister.com/2026/04/07/microsoft_device_code_phishing/)
- [Kali365 Phishing-as-a-Service Kit Hijacks Microsoft 365 Access Tokens](https://www.ic3.gov/PSA/2026/PSA260521)
- [Forg365 PhaaS Targets Microsoft 365 with Device Code and AitM Session Theft](https://thehackernews.com/2026/07/forg365-phaas-targets-microsoft-365.html)
- [Steal Application Access Token, Technique T1528 - Enterprise | MITRE ATT&CK](https://attack.mitre.org/techniques/T1528/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1306