# Two New Phishing Kits Weaponize MFA Bypass Techniques Against Microsoft 365 Users


A pair of sophisticated phishing kits discovered in active attacks demonstrate how threat actors are systematically defeating multi-factor authentication (MFA) to compromise Microsoft 365 accounts. Identified as Jalisco and OmegaLord, these tools represent an escalation in phishing-kit sophistication, moving beyond simple credential theft to target organizations that have already deployed MFA protections. Security researchers warn that the kits are actively being deployed across multiple industries, with particular focus on high-value targets including enterprise organizations and government agencies.


## The Threat


Jalisco and OmegaLord operate as comprehensive phishing frameworks designed to intercept and manipulate the Microsoft 365 authentication flow. Rather than simply capturing usernames and passwords, these kits employ reverse proxy and token interception techniques to bypass MFA entirely:


  • Real-time credential relay: Both kits intercept login credentials and MFA tokens in real time, forwarding them to legitimate Microsoft services while capturing the authentication session
  • Session hijacking: Once authenticated, the attacker gains direct access to the user's account without needing to re-authenticate
  • Persistent access: Threat actors can establish backdoor access methods, including mailbox rules, device enrollment, and OAuth app permissions
  • User-transparent operation: Victims may never realize their credentials were compromised, as the phishing interface redirects them to a legitimate login confirmation

    • Unlike earlier phishing kits that relied on password theft alone, Jalisco and OmegaLord are purpose-built to circumvent modern security controls, making them significantly more dangerous than commodity phishing tools.


    ## Background and Context


    Microsoft 365 has become the de facto standard for enterprise productivity globally, with over 400 million active users across organizations. This ubiquity makes it an attractive target for threat actors seeking to:


    1. Gain enterprise access for lateral movement and data exfiltration

    2. Establish persistence through email forwarding rules and cloud app registrations

    3. Conduct targeted espionage against government and private sector organizations

    4. Enable business email compromise (BEC) scams with authentic account access


    The MFA Problem: While MFA has significantly improved security posture over password-only authentication, it is not a silver bullet. Session-hijacking techniques allow attackers to bypass MFA entirely by intercepting the authentication session *after* legitimate credentials and MFA codes have been validated. This attack vector, sometimes called "post-authentication interception," has been documented in attacks on major cloud platforms but remains underestimated by many organizations.


    The emergence of Jalisco and OmegaLord as *packaged, easy-to-deploy* tools suggests that sophisticated MFA-bypass techniques are becoming commoditized—meaning smaller threat groups now have access to capabilities once reserved for state-sponsored actors.


    ## Technical Details


    Both phishing kits employ similar underlying mechanics, though with distinct operational characteristics:


    ### Reverse Proxy Architecture


    Rather than hosting a static phishing page, Jalisco and OmegaLord deploy reverse proxies that sit between the victim and Microsoft's authentication servers:


    1. User receives phishing email with legitimate-looking Microsoft login link

    2. Clicking the link directs to attacker-controlled proxy server

    3. Proxy transparently forwards all traffic to microsoft.com while logging credentials and tokens

    4. Victim logs in normally and completes MFA as if nothing is wrong

    5. Attacker captures the encrypted session token and uses it to access the account


    ### MFA Token Interception


    Both kits are capable of intercepting and replaying MFA tokens through several methods:


  • TOTP cloning: Capturing time-based one-time passwords (TOTP) from authenticator apps and replaying them before token expiration
  • Push notification interception: Intercepting Microsoft Authenticator app approval requests and obtaining session tokens
  • OTP resend exploitation: Triggering SMS resend and capturing codes in real time before they expire

    • ### Post-Authentication Persistence


    Once initial access is gained, the kits automatically:


  • Register malicious OAuth applications that persist even after password changes
  • Create mailbox forwarding rules to exfiltrate sensitive emails
  • Enroll attacker devices in conditional access policies, legitimizing future logins
  • Create cloud-based app identities that act as persistent backdoors

    • ## Implications for Organizations


    The impact of successful Jalisco or OmegaLord attacks extends far beyond credential compromise:


    | Attack Stage | Potential Impact |

    |---|---|

    | Initial Access | Unauthorized account takeover, immediate access to emails, OneDrive, Teams |

    | Lateral Movement | Access to all integrated cloud apps (Salesforce, Slack, GitHub, etc.) |

    | Data Exfiltration | Months of undetected email copying, document theft, intellectual property loss |

    | Persistence | Continued access even after password resets or MFA enforcement |

    | Downstream Attacks | Compromised accounts used for BEC, supply chain compromise, secondary payload delivery |


    At-Risk Sectors: Healthcare organizations, financial institutions, government agencies, and technology companies report the highest attack volumes, though all sectors are targeted.


    ## Recommendations


    Organizations must move beyond treating MFA as a complete security solution:


    ### Immediate Actions

  • Audit OAuth app permissions: Search Azure AD for suspicious or unfamiliar applications, particularly those with Mail.Read or Mail.ReadWrite permissions
  • Review mailbox rules: Check for unusual forwarding rules, especially those targeting external addresses
  • Enable conditional access policies: Require device compliance and location verification for sensitive operations
  • Implement email security controls: Deploy sandboxing and URL rewriting for external emails containing Microsoft login links

    • ### Medium-Term Defenses

  • Deploy passwordless authentication: Windows Hello, FIDO2 security keys, or phone sign-in eliminate phishing entirely for these auth methods
  • Monitor for suspicious activity: Alert on impossible travel, geographic anomalies, and unusual bulk email operations
  • Enforce device attestation: Require Intune enrollment and compliance checks before granting access
  • Implement zero-trust network access: Use identity-based VPN and app proxies rather than broad network access

    • ### Detection Strategies

  • Monitor for spike in failed MFA attempts followed by successful logins from new devices
  • Alert on mailbox rule creation from unfamiliar IP addresses
  • Track OAuth consent grants to applications without legitimate business purpose
  • Monitor for SMS/email forwarding rule changes

    • ## HackWire Analysis


    The emergence of Jalisco and OmegaLord marks a critical inflection point: MFA bypass is no longer an exotic attack reserved for nation-states, but a commodity capability packaged for mass-market threat actors. This shift demands an honest reckoning about security posture assumptions.


    For years, the industry has marketed MFA as the solution to credential compromise. While effective against many attacks, these phishing kits demonstrate that *session hijacking at the authentication layer* defeats MFA by design—the attacker never needs the password or MFA code, because they capture the authenticated session itself. This isn't a novel attack vector, but its weaponization into deployable, affordable toolkits suggests that defenders have been one step behind.


    What's particularly concerning is the *speed of commoditization*. Advanced MFA-bypass techniques appeared in nation-state tooling ~3-4 years ago. Now they're being actively marketed to criminal groups. This compressed timeline means organizations that assumed "We deployed MFA, so we're protected" are critically exposed.


    The real defense requires shifting from "prevent credential theft" to "assume accounts will be compromised, make persistence expensive." This means OAuth monitoring, device compliance enforcement, and behavioral detection that assumes the account is legitimate but the user context is wrong. Organizations that continue relying on MFA alone as their primary defense strategy should expect breaches in 2026.


    The second layer: these attacks specifically target *Microsoft 365 accounts*, which are often the crown jewels of corporate infrastructure. Unlike a compromised WordPress blog, a compromised Microsoft account gives attackers email, calendars, file systems, and the trust relationships within an organization. The ROI for phishing attacks against M365 is exceptionally high, which explains why these toolkits have evolved so aggressively.


    — *HackWire Editorial*


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)