Identity & AccessJul 14, 2026

New phishing kits target Microsoft 365 accounts, evade MFA

Two phishing kits, Jalisco and OmegaLord, target Microsoft 365 accounts with MFA-bypass techniques.

Researchers at ReliaQuest discovered two new phishing kits—Jalisco and OmegaLord—designed to compromise Microsoft 365 accounts while defeating multi-factor authentication. Jalisco exploits the OAuth 2.0 Device Authorization Grant flow to trick users into authorizing attacker-controlled devices, while OmegaLord masquerades as a PDF reader to steal credentials and phone numbers. Both toolkits represent evolving phishing tactics that directly target MFA protections, with attackers exfiltrating sensitive data from compromised accounts in minutes.

AI summary of the linked source. Not reviewed by an editor. How this works

Read at source

Vendor Watch

Run ReliaQuest?

Get an email when a new story names ReliaQuest, usually within the hour.

Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch works Privacy

The lesson from this incident

Full lesson

Attackers have developed sophisticated phishing kits that specifically circumvent multi-factor authentication, long considered a strong defensive baseline. Jalisco abuses the legitimate OAuth 2.0 Device Authorization Grant flow to trick users into granting access to attacker-controlled devices, while OmegaLord harvests credentials and phone numbers by impersonating a PDF reader. These kits demonstrate that MFA alone is not a silver bullet—user awareness and stricter authentication controls are equally critical. The speed of data exfiltration (within minutes of compromise) underscores the need for real-time detection and rapid incident response capabilities.

What helps against this

How we list vendors

Microsoft affected ReliaQuest research

Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
For exampleOkta Workforce Identity Yubico YubiKey Microsoft Entra ID all options
Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
For exampleAcalvio ShadowPlex Identity Protection Microsoft Defender for Identity Okta Identity Threat Protection all options
Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
For exampleAbnormal AI Abnormal Inbound Email Security Check Point Harmony Email & Collaboration Darktrace / EMAIL all options

Indicators of Compromise

Extracted by AI from the linked source. Not reviewed by an editor. How this works

malware — Jalisco
malware — OmegaLord
malware — EvilTokens
malware — Kali365
malware — Tycoon2FA
malware — Venom
malware — Forg365

Entities

Microsoft 365 (product)Microsoft Entra ID (product)Okta (product)ReliaQuest (vendor)OAuth 2.0 Device Authorization Grant (technology)SharePoint (technology)