Phishing Kits Adapt to Bypass MFA Flows

Cybersecurity researchers have identified two sophisticated phishing kits, Jalisco and OmegaLord, designed specifically to circumvent multi-factor authentication (MFA) protections within Microsoft 365 environments. These tools represent a shift in attacker methodology, moving beyond simple credential harvesting to exploit the complex authentication flows and device registration processes relied upon by modern enterprises.

Tactical Exploitation of Device Codes

The Jalisco toolkit focuses on the OAuth 2.0 Device Authorization Grant flow. By initiating a sign-in request to a Microsoft service, the attacker triggers the generation of a device authorization code. Through social engineering, victims are lured to a legitimate Microsoft login page where they enter the attacker's code, inadvertently authorizing a malicious device to access their account.

To maintain operational viability, the Jalisco kit generates these codes in real-time. This automated provisioning effectively nullifies the 15-minute validity window typically enforced by Microsoft to mitigate such threats. Once access is established, operators can manage sessions through a dedicated web portal and frequently register multiple rogue devices—sometimes under names mimicking Microsoft or Windows—on a single account.

Credential Theft and Data Exfiltration

While Jalisco targets device authorization, OmegaLord employs a more conventional, albeit targeted, approach. This kit masquerades as a PDF reader login page, capturing email addresses, passwords, and phone numbers. The collection of phone numbers is a key feature, as it provides attackers with the necessary information to intercept or manipulate MFA prompts directly.

Upon successful compromise, the urgency of the attackers' actions is significant. Threat actors frequently scan SharePoint and other SaaS platforms to identify and exfiltrate valuable data, often completing these actions within minutes of initial access before pivoting to extortion tactics.

Threat actors use compromised accounts to access sensitive data, such as customer or employee personally identifiable information (PII), financial records, and internal communications stored in SharePoint and other SaaS platforms

— ReliaQuest, cybersecurity firm

Mitigation Through Configuration Hardening

Addressing these risks requires granular control over how devices and applications interact with identity services. Experts suggest organizations move away from default settings, particularly regarding device registration limits, which are often set too high to manage effectively during an incident response scenario.

• Decrease the Entra ID device-registration limit from the default value of 50 to one or two.
• Block device code authentication via Microsoft Entra Conditional Access.
• Restrict the OAuth Device Authorization grant within Okta environments.
• Audit and remove all unnecessary application registrations to reduce the attack surface.

Implications for Security Posture

The emergence of kits like Jalisco, which join a list including EvilTokens, Kali365, Tycoon2FA, Venom, and Forg365, suggests that standard MFA is no longer a sufficient barrier against persistent threat actors. Organizations that rely solely on default authentication settings may find their defenses easily bypassed by automated toolkits. Proactive monitoring of device registration logs and strict application of conditional access policies could be the difference between identifying a compromise early and losing sensitive corporate data in a matter of minutes.