New phishing kits target Microsoft 365 accounts, evade MFA

Researchers at ReliaQuest analyzed two phishing kits—Jalisco, which automates Microsoft OAuth device-code phishing to authorize attacker-controlled devices, and OmegaLord, which poses as a PDF reader to steal credentials and phone numbers—both engineered to bypass MFA, enable account takeover, rapidly exfiltrate SaaS/SharePoint data, and facilitate extortion; recommended mitigations include tightening device-registration limits, blocking device-code authentication in conditional access, and auditing app registrations.