Loading story…
Researchers identified two phishing-as-a-service kits, TokenLover and YaksaLover, that automate Microsoft 365 business email compromise operations and package them in multi-tenant dashboards resembling legitimate SaaS platforms. The kits combine established techniques including device-code phishing, FOCI token pivoting, Primary Refresh Token theft, ESTS cookie generation, internal phishing, and persistence through synthetic Windows Hello for Business key registration, allowing less-skilled operators to run full BEC campaigns at scale.
TokenLover is designed for post-compromise automation, using AI to analyze mailboxes, map payment workflows, and support invoice fraud, while YaksaLover emphasizes campaign deployment, token harvesting, and real-time email forwarding from compromised accounts. Because phishing messages can be sent from victims’ genuine Microsoft 365 accounts, they may pass SPF and DKIM checks and appear as legitimate internal mail, and researchers warned that the Windows Hello persistence mechanism can survive password resets unless organizations fully revoke device identities, keys, and active sessions.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Eye Security published research on two newly identified phishing-as-a-service kits, TokenLover and YaksaLover, describing how they automate Microsoft 365 business email compromise workflows including device-code phishing, token theft, persistence, and AI-assisted fraud operations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
acn.gov.it
Open sourceresearch.eye.security
Open sourcereddit.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A sophisticated phishing campaign has emerged, leveraging AI-assisted development to target Microsoft Outlook users, particularly Spanish speakers. The operation, active since March 2025, employs a modular phishing kit that mimics the Outlook login interface and uses real-time reconnaissance to enrich stolen credentials with IP and geolocation data. Stolen information is exfiltrated via Telegram bots and Discord webhooks, and the kit's evolution shows clear signs of AI-generated code, including clean structure and Spanish-language comments. Researchers identified the campaign through a unique mushroom emoji signature embedded in the phishing kit, which has been observed in over 75 deployments. In a parallel development, another phishing wave has exploited Google Cloud Application Integration to send convincing emails from legitimate Google addresses, bypassing traditional security filters. This campaign, uncovered by Check Point researchers, uses a multi-stage process: victims receive official-looking emails, are redirected through Google infrastructure, and ultimately land on a fake Microsoft login page designed to harvest credentials. The attack has targeted over 3,000 organizations globally, with significant activity in the United States, Asia-Pacific, and Europe. Both campaigns demonstrate the increasing sophistication and global reach of phishing operations using advanced technical methods and trusted platforms to deceive users.
Jun 29, 2026
Active phishing campaigns are using the **Jalisco** and **OmegaLord** kits to compromise Microsoft 365 accounts with techniques designed to bypass or weaken multi-factor authentication. According to ReliaQuest, Jalisco abuses the OAuth 2.0 device authorization flow by generating fresh Microsoft device codes in real time and tricking victims into authorizing attacker-controlled devices, allowing attackers to obtain OAuth tokens without directly stealing passwords. OmegaLord uses a fake PDF reader login page to harvest credentials and victims’ phone numbers, which may help attackers intercept or manipulate MFA challenges. After gaining access, attackers have been observed moving quickly through SharePoint and other SaaS platforms to locate and exfiltrate sensitive data, sometimes within minutes, and may follow with extortion threats. ReliaQuest also reported that threat actors register multiple devices to compromised Microsoft Entra ID accounts to preserve access and refresh tokens even after password resets, reflecting a broader surge in phishing-as-a-service activity tied to platforms including **EvilTokens**, **Kali365**, **Tycoon2FA**, **Venom**, and **Darcula**. Defenders are being urged to reduce Entra ID device-registration limits, disable or restrict device code authentication through Conditional Access or Okta where not needed, and audit unnecessary app registrations.
Jul 23, 2026
Researchers reported that **Forg365**, a phishing-as-a-service platform marketed through Telegram, is targeting **Microsoft 365** and other Microsoft accounts with a mix of adversary-in-the-middle phishing, **device-code phishing**, session theft, and post-compromise mailbox access. The service includes an operator panel with AI-assisted lure generation, impersonation templates for Microsoft services, SMTP rotation, campaign scheduling, token storage, and mailbox keyword monitoring, giving attackers an end-to-end workflow for credential theft and account takeover. Investigators said Forg365 can capture authentication tokens, browser cookies, and session data, while a companion browser extension, **ForgCookie**, refreshes Microsoft single sign-on cookies to preserve access without repeated reauthentication. Observed infrastructure included **Amazon SES** for email delivery, **SendGrid**-hosted resources, **Cloudflare Pages** landing pages, and **Gophish** components, alongside anti-analysis measures such as bot detection, debugger traps, sandbox checks, encrypted redirectors, and VPN-based benign redirection. Defenders were urged to restrict device-code authentication where possible, monitor **Microsoft Entra** logs, OAuth and Microsoft Graph activity, suspicious device registrations, and rapidly revoke sessions, refresh tokens, and OAuth access after suspected compromise.
Jul 14, 2026