Technical analysis of Jalisco and OmegaLord, two advanced phishing kits designed to exploit the OAuth 2.0 Device Authorization Grant and bypass multi-factor authentication, leading to rapid SaaS data exfiltration within minutes of initial access.
Abusing the legitimate OAuth 2.0 Device Authorization Grant flow allows threat actors to bypass multi-factor authentication (MFA) and register rogue endpoints within enterprise environments. Two newly discovered phishing toolkits, Jalisco and OmegaLord, are actively exploiting these authentication frameworks to compromise Microsoft 365 accounts and exfiltrate corporate SaaS data. These campaigns demonstrate a structural shift in phishing engineering, transitioning from basic credential harvesting to sophisticated session and device hijacking that directly undermines modern identity protections.
The Jalisco phishing kit specifically targets the Device Authorization Grant, an OAuth 2.0 protocol designed for devices with limited input capabilities, such as smart TVs or printers. In a standard workflow, this protocol generates a code that the user enters on a separate device to complete authentication. Attackers have weaponized this flow by initiating a sign-in request to Microsoft 365, forcing the platform to generate an active device authorization code. Using targeted social engineering lures, the threat actor directs the victim to navigate to the legitimate Microsoft device login page and submit the generated code, inadvertently authorizing the attacker-controlled machine.
Unlike historical device-code campaigns that struggled with Microsoft’s standard 15-minute expiration window for generated codes, Jalisco implements an automated backend API. The moment a victim opens the phishing landing page, the kit requests a fresh device code from Microsoft’s identity provider in real-time. This eliminates the expiration constraint and ensures that the victim is presented with a valid, active code. Once the victim inputs the code on the official Microsoft authentication page and completes their standard MFA prompt, Microsoft issues OAuth access and refresh tokens. These tokens are instantly intercepted by Jalisco and transmitted back to the attacker’s command and control (C2) web portal.
With these stolen tokens, the threat actor achieves persistent access without ever obtaining the user’s master password. Jalisco’s web portal allows operators to manage active sessions and register up to five rogue devices within the victim’s Microsoft Entra ID tenant. To evade detection during security audits, the attackers name these rogue devices with deceptive prefixes, such as naming them after Windows or Microsoft systems, to blend in with authorized endpoints. These rogue devices receive a Primary Refresh Token (PRT), securing long-term persistence that survives standard password resets and session revocations.
Victim visits cloudflare workers or edgeone.app hosting a real-time lure.
Jalisco backend triggers Microsoft for an active authentication code.
Victim is prompted to complete Microsoft's authentic device-login process.
Tokens returned by MS are forwarded straight to Jalisco's C2 web portal.
Up to 5 rogue devices registered as 'Windows/Microsoft' to capture PRTs.
If your team may be exposed to a similar threat, FemtoSec can help validate blast radius, prioritize remediation, and connect the issue to a practical security program.
July 5, 2026
A sophisticated Phishing-as-a-Service platform called ARToken has emerged, targeting Microsoft 365 users. By weaponizing OAuth 2.0 Device Authorization Grants, the platform bypasses MFA to capture persistent access tokens, posing a critical security threat to enterprise tenants across the GCC region.
June 30, 2026
A deep dive into the Bluekit and SnagX Phishing-as-a-Service platforms, analyzing how threat actors utilize Adversary-in-the-Middle reverse proxies to bypass multi-factor authentication and execute automated account takeovers targeting e-commerce credentials.
June 26, 2026
A targeted spearphishing campaign linked to Russian intelligence services focuses on stealing Signal Backup Recovery Keys. By exploiting the human layer, attackers reconstruct private messaging archives without breaking the underlying cryptographic protocol.
Free exposure check
Dark Web Scanner
check dark web mentions, compromised account indicators, malware log signals, public breach exposure, and recent underground market activity for your domain.
While Jalisco relies on the abuse of device-authorization protocols, OmegaLord utilizes a decoy PDF reader utility to harvest high-value credentials and contact details. The campaign begins by redirecting users to a fake application interface that prompts them to enter their corporate email address, password, and their associated mobile phone number. Collecting the user’s telephone number is a deliberate step to facilitate downstream MFA interception. With direct access to the user’s phone number, attackers can launch secondary cellular attacks, including targeted SMS redirection, cellular-based interception, or SIM-swapping, to bypass standard telephony-based multi-factor authentication.
These developments emphasize how threat actors are engineering directly around MFA as a security control. Rather than attempting to crack complex passwords, attackers are targeting the transport layers of the authentication process itself, either by stealing pre-authenticated OAuth sessions or by gathering the precise secondary identification points needed to hijack the MFA validation loop.
The operational impact of a compromise by Jalisco or OmegaLord is exceptionally rapid. Upon securing persistence, attackers immediately abuse their authorized sessions to query internal SaaS resources, specifically searching SharePoint and OneDrive repositories for sensitive data. Threat actors prioritize the discovery and collection of customer and employee personally identifiable information (PII), financial ledgers, and proprietary internal communications. This search and exfiltration cycle is highly automated, with researchers observing complete data theft occurring in as little as six minutes after initial access. This speed makes manual containment incredibly challenging, as data is often exfiltrated before security teams can triage the initial anomalous login alert. Following successful exfiltration, attackers typically pivot to extortion, threatening to release the harvested files publicly unless a ransom is paid.
To prevent these highly rapid data breaches, organizations must proactively audit their exposed entry points. If you want to check if your domain has already been targeted in underground credential markets or associated phishing dumps, you can utilize FemtoSec’s diagnostic scanning tools. If the domain already looks exposed, use the Dark Web Scanner before requesting a full report.
The behavior of Jalisco and OmegaLord maps to several established MITRE ATT&CK techniques, showcasing the breadth of their defensive evasion and data collection actions:
T1566 (Phishing): Both kits utilize high-reputation subdomains and cloud storage providers to distribute credential lures and bypass secure email gateways.
T1557 (Adversary-in-the-Middle): Jalisco intercepts the live OAuth authorization loop between the target and the identity provider.
T1649 (Steal or Forge Authentication Certificates): Attackers harvest active access and refresh tokens to access SaaS platforms directly.
T1098 (Account Manipulation): Attackers register up to five unauthorized endpoints on the Entra ID tenant to acquire persistent Primary Refresh Tokens.
T1036 (Masquerading): Rogue endpoints are named with benign terms like Windows or Microsoft to bypass basic administrative reviews.
T1213 (Data from Information Repositories): Rapid, scripted harvesting of corporate data from SharePoint and other connected SaaS document hubs.
Defenders must move beyond legacy authentication paradigms to counter automated token-theft toolkits. Standard hardening measures should be deployed across Microsoft Entra ID and connected identity systems to neutralize the core vectors utilized by Jalisco and OmegaLord.
First, organizations should restrict or disable the device code authentication flow. This can be achieved by writing a Microsoft Entra Conditional Access policy that blocks device code flows for all users and all cloud applications. Exceptions should be tightly controlled and restricted solely to verified service accounts with documented requirements. Second, administrators must reduce the default Entra ID device registration limit. By default, Microsoft Entra ID allows a single user to register up to 50 devices. Reducing this limit to one or two significantly hinders an attacker’s capacity to establish multiple persistent rogue endpoints.
Furthermore, organizations must transition away from telephonic authentication, such as SMS or voice codes, which OmegaLord is designed to exploit. Transitioning to phishing-resistant authentication methods, such as FIDO2 security keys or Windows Hello for Business, prevents these kits from successfully intercepting the credentials needed to gain access. Regular testing of these authentication configurations is critical. Utilizing expert Penetration Testing services can help validate that your identity provider policies are correctly configured and resilient to advanced adversary-in-the-middle attacks.
Security teams can deploy the following Kusto Query Language (KQL) detections within Microsoft Sentinel or advanced hunting environments to identify signs of Jalisco or OmegaLord activity.
To monitor Sign-In logs for successful authentications that rely on the Device Code flow, utilize this query:
SigninLogs
| where AuthenticationProtocol == 'deviceCode'
| where ResultType == 0
| summarize Count=count() by UserPrincipalName, IPAddress, Location, ClientAppUsed, OperatingSystem=DeviceDetail.operatingSystem
| order by Count descTo identify instances where a new device enrollment occurs in close temporal proximity to a successful sign-in, deploy this correlation query:
let anomalous_signin = SigninLogs
| where ResultType == 0
| project SigninTime = TimeGenerated, UserPrincipalName, IPAddress, Location;
AuditLogs
| where OperationName == 'Register device'
| project RegistrationTime = TimeGenerated, UserPrincipalName = tostring(TargetResources[0].userPrincipalName), DeviceName = tostring(TargetResources[0].displayName)
| join kind=inner anomalous_signin on UserPrincipalName
| where RegistrationTime between (SigninTime .. (SigninTime + 30m))
| project RegistrationTime, UserPrincipalName, DeviceName, IPAddress, LocationTo sweep your tenant specifically for rogue device registrations that attempt to masquerade as trusted vendor endpoints, use this detection:
AuditLogs
| where OperationName == 'Register device'
| extend DeviceName = tostring(TargetResources[0].displayName)
| where DeviceName i_contains 'microsoft' or DeviceName i_contains 'windows'
| project TimeGenerated, InitiatedBy=Identity, DeviceName, ResultIf an alert indicates a potential compromise, incident response teams must work rapidly to prevent exfiltration. The first step is to forcefully terminate all active user sessions within Entra ID. This invalidates the stolen OAuth access tokens and prevents further immediate API access. Second, administrators must revoke the refresh tokens of the compromised account using administrative PowerShell commands or the Entra ID administration portal. Third, verify the affected user’s registered devices and delete any unknown endpoints, paying close attention to those added around the time of the alert. Finally, inspect the Unified Audit Logs for signs of high-volume file access or downloads in SharePoint or OneDrive, and remove any unrecognized enterprise app registrations that may have been authorized during the incident.
Maintaining an active posture against identity threats requires a continuous approach to vulnerability identification and external exposure mapping. Implementing continuous Dark Web Monitoring ensures that your security teams receive real-time alerts if corporate credentials or session logs are traded on underground markets, allowing you to secure compromised accounts before attackers can initiate their exfiltration workflows.