Jalisco, OmegaLord Phishing Kits Target Microsoft 365 Accounts

ReliaQuest researchers disclosed two active phishing toolkits—Jalisco and OmegaLord—targeting Microsoft 365 environments by defeating MFA: Jalisco generates real-time OAuth device codes to capture session tokens, and OmegaLord simulates login pages to steal credentials and phone numbers for MFA interception. Attackers can persist by registering malicious devices that refresh tokens even after password resets, and AI-powered phishing-as-a-service platforms are accelerating the scale and sophistication of these campaigns, prompting recommendations to restrict device-code authentication and strengthen identity controls.