New Phishing Tools Enable Attackers to Easily Bypass Multifactor Authentication

ReliaQuest researchers have identified two phishing toolkits that bypass MFA: “Jalisco,” a device-code phishing platform that provisions fresh OAuth device codes in real time (including lure-generation to neutralize TTL protections), and “OmegaLord,” a JavaScript credential harvester that unusually also collects phone numbers to intercept or hijack MFA. Both tools are being used in the wild and, when paired with AI-powered phishing-as-a-service, enable account takeover, persistence in Microsoft 365/Entra ID tenants, and rapid SaaS data exfiltration for extortion.