Loading story…
Active phishing campaigns are using the Jalisco and OmegaLord kits to compromise Microsoft 365 accounts with techniques designed to bypass or weaken multi-factor authentication. According to ReliaQuest, Jalisco abuses the OAuth 2.0 device authorization flow by generating fresh Microsoft device codes in real time and tricking victims into authorizing attacker-controlled devices, allowing attackers to obtain OAuth tokens without directly stealing passwords. OmegaLord uses a fake PDF reader login page to harvest credentials and victims’ phone numbers, which may help attackers intercept or manipulate MFA challenges.
After gaining access, attackers have been observed moving quickly through SharePoint and other SaaS platforms to locate and exfiltrate sensitive data, sometimes within minutes, and may follow with extortion threats. ReliaQuest also reported that threat actors register multiple devices to compromised Microsoft Entra ID accounts to preserve access and refresh tokens even after password resets, reflecting a broader surge in phishing-as-a-service activity tied to platforms including EvilTokens, Kali365, Tycoon2FA, Venom, and Darcula. Defenders are being urged to reduce Entra ID device-registration limits, disable or restrict device code authentication through Conditional Access or Okta where not needed, and audit unnecessary app registrations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
ReliaQuest said attackers were maintaining persistence on compromised Microsoft Entra ID accounts by registering multiple devices. This allowed continued token refresh and access even after victims reset their passwords.
ReliaQuest reported active phishing campaigns targeting Microsoft 365 accounts using the Jalisco and OmegaLord kits. The report said Jalisco abuses OAuth 2.0 device-code phishing and OmegaLord uses a fake PDF reader login page to steal credentials and phone numbers that may help attackers bypass MFA.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
blog.knowbe4.com
Open sourceinfosecwriteups.com
Open sourcetechrepublic.com
Open sourcebleepingcomputer.com
Open sourcereliaquest.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and incident responders are warning that attackers are increasingly abusing Microsoft Entra ID's OAuth 2.0 **device code flow** to hijack Microsoft 365 accounts through legitimate sign-in prompts rather than malware or software exploits. In these attacks, victims are tricked via **vishing** or phishing into entering an attacker-supplied code at Microsoft's device login page and approving MFA, which issues the attacker valid access and refresh tokens. Security firms say the technique can provide broad access to services including **Microsoft Graph**, **Exchange Online**, **OneDrive**, and **SharePoint**, and that password resets alone may not fully contain the intrusion because refresh tokens can persist across services. The activity has been tied to data theft and follow-on abuse. ReliaQuest reported that the **Helix** extortion group used device code phishing, MFA abuse, and rogue authenticator registration to access victim Microsoft 365 tenants, enumerate SharePoint, and exfiltrate data before extortion; reported victims include Medtronic, Nissan, NAIC, Kodak, Infinite Campus, and the University of Nottingham. Separate investigations documented attackers signing in from foreign locations, registering multiple devices, creating hidden inbox rules to suppress replies, and using compromised mailboxes to send phishing messages at scale. Microsoft and security researchers recommend blocking or restricting device code authentication with **Conditional Access**, limiting SharePoint and device registration to managed devices, and monitoring Entra ID telemetry for `AuthenticationProtocol` set to device code, unusual travel, mailbox rule changes, and spikes in device registrations.
Jul 23, 2026
A wave of sophisticated phishing campaigns is targeting organizations globally to steal Microsoft 365 credentials by bypassing traditional email security gateways and multi-factor authentication (MFA) protections. Attackers are employing advanced techniques such as multi-stage payload delivery using nested PDF attachments, legitimate content delivery networks, and mouse tracking to evade detection. Once victims interact with these emails and enter their credentials on a credential harvesting site, attackers leverage legitimate Microsoft infrastructure to bypass MFA and gain immediate access to the victim’s Microsoft 365 environment. These campaigns are engineered to filter out security analysts and block standard security tools, making detection and response more challenging. In parallel, threat actors are increasingly using attacker-in-the-middle toolkits like Evilginx and hybrid phishing-as-a-service kits such as Salty2FA and Tycoon2FA to capture both user credentials and session cookies. By stealing session cookies, attackers can impersonate users and maintain access without triggering additional MFA prompts, even after successful authentication. The blending of different phishing kits into hybrid strains is making detection harder, as traditional security rules tuned to individual kits are now being evaded. Security researchers warn that static indicators are no longer sufficient, and behavioral analysis is required to spot these evolving threats.
Jun 29, 2026
Microsoft disclosed a large-scale phishing campaign that targeted more than **35,000 users** at over **13,000 organizations** across **26 countries**, with most victims in the United States and concentrations in healthcare, life sciences, financial services, professional services, and technology. The operation used code-of-conduct and compliance-themed emails delivered through legitimate email services, including abuse of platforms such as Amazon SES, to make messages appear trustworthy and help them pass common email authentication checks. Victims received PDF attachments containing links that led through fake CAPTCHA and document-review pages before landing on spoofed Microsoft sign-in portals. Microsoft said the attackers used an **adversary-in-the-middle** phishing flow to capture credentials and authentication tokens in real time, allowing them to bypass weak multifactor authentication and gain immediate account access. The company described the activity as one of the most sophisticated code-of-conduct-themed credential theft campaigns it has observed and said it reflects broader trends including CAPTCHA-gated phishing, QR-code phishing, and phishing-as-a-service ecosystems such as **Tycoon 2FA**, **Kratos**, and **EvilTokens**. Microsoft urged organizations to strengthen defenses with Defender for Office 365, SmartScreen-enabled browsers, phishing awareness training, stronger authentication, conditional access policies, and automated attack disruption in Defender XDR.
Jun 29, 2026