Jalisco and OmegaLord Phishing Kits Target Microsoft 365, Aim to Bypass MFA
Summary
ReliaQuest says Jalisco uses OAuth device-code phishing and OmegaLord imitates a PDF Reader login to target Microsoft 365 accounts and work around MFA. It recommends restricting device registration and blocking device-code authentication.
Key points
- ReliaQuest says Jalisco abuses OAuth 2.0 Device Authorization Grant by persuading victims to authorize an attacker-controlled device.
- Jalisco can reportedly generate fresh device codes in real time, bypassing the 15-minute validity period.
- ReliaQuest says Jalisco includes a portal for managing captured sessions and compromised accounts.
- OmegaLord imitates a PDF Reader login page to collect email addresses, passwords, and phone numbers, which may help attackers hijack MFA requests or codes.
- ReliaQuest reports seeing attackers register as many as five rogue devices on one compromised account.
- ReliaQuest says attackers may search SharePoint and other SaaS services for sensitive data and exfiltrate it quickly; these are reported observations, not confirmation of every incident.
- Recommended measures include limiting Entra ID device registrations, blocking device-code authentication through Conditional Access, and auditing unnecessary app registrations.
Article Details
- Event Type
- Phishing kits targeting Microsoft 365 accounts and designed to bypass multi-factor authentication.
- Impact
- Jalisco uses device-code phishing to authorize attacker-controlled devices; OmegaLord impersonates a PDF Reader login page to steal credentials and phone numbers that may help attackers bypass MFA. ReliaQuest reports that attackers using compromised accounts can quickly access and exfiltrate sensitive data from SharePoint and other SaaS services, then make extortion demands. The article does not identify a specific victim or confirmed incident.
MITRE ATT&CK
Vendors
Products
Entra IDReliaQuest recommends that the Entra ID device-registration limit be reduced from the default value of ‘50’ down to one or two, which would also help reduce response and remediation times in case of account hijackMicrosoft 365 Apps for EnterpriseTwo new phishing kits, Jalisco and OmegaLord, are targeting Microsoft 365 accounts with methods designed to bypass multi-factor authentication.Microsoft SharePointAfter compromising an account, attackers search SharePoint and other SaaS services for valuable data and exfiltrate it within a few minutes, then follow up with extortion demands and threaten to leak it.
Tools
JaliscoTwo new phishing kits, Jalisco and OmegaLord, are targeting Microsoft 365 accounts with methods designed to bypass multi-factor authentication.OmegaLordTwo new phishing kits, Jalisco and OmegaLord, are targeting Microsoft 365 accounts with methods designed to bypass multi-factor authentication.