Hackers Abuse OAuth Device Codes and Entra ID Enrollment for Persistent SaaS Access

This report describes evolving AI-enabled phishing-as-a-service campaigns (notably Jalisco and OmegaLord) that generate OAuth device codes in real time and abuse Microsoft Entra ID device enrollment to capture access/refresh tokens and acquire Primary Refresh Tokens (PRTs), enabling MFA bypass and durable persistence across password resets. The toolkits enable scalable credential- and token-theft, rapid data exfiltration, and enrollment of malicious devices; the report includes IOCs, examples, and actionable mitigations such as disabling device code flow where unused, auditing application and device registrations, revoking sessions, and monitoring anomalous token and device activity.