MITRE ATT&CK
OmegaLord in ATT&CK
7 distinct techniquesReporting
Research mentioning OmegaLord
Jul 23
Knowbe4
New Phishing Tools Enable Attackers to Easily Bypass Multifactor Authentication
Active phishing campaigns are using the Jalisco and OmegaLord kits to compromise Microsoft 365 accounts with techniques designed to bypass or weaken multi-factor authentication. According to ReliaQuest, Jalisco abuses the OAuth 2.0 device authorization flow by generating fresh Microsoft device codes in real time and tricking victims into authorizing attacker-controlled devices, allowing attackers to obtain OAuth tokens without directly stealing passwords. OmegaLord uses a fake PDF reader login page to harvest credentials and victims’ phone numbers, which may help attackers intercept or manipulate MFA challenges. After gaining access, attackers have been observed moving quickly through SharePoint and other SaaS platforms to locate and exfiltrate sensitive data, sometimes within minutes, and may follow with extortion threats. ReliaQuest also reported that threat actors register multiple devices to compromised Microsoft Entra ID accounts to preserve access and refresh tokens even after password resets, reflecting a broader surge in phishing-as-a-service activity tied to platforms including EvilTokens, Kali365, Tycoon2FA, Venom, and Darcula. Defenders are being urged to reduce Entra ID device-registration limits, disable or restrict device code authentication through Conditional Access or Okta where not needed, and audit unnecessary app registrations.
Jul 18
Infosec Writeups
Medium
Jul 15
Techrepublic Com Security
Jalisco, OmegaLord Phishing Kits Target Microsoft 365 Accounts
Jul 14
ReliaQuest
Threat Spotlight: The Jalisco Toolkit and AI-Powered Phishing Surge
Jul 14
Bleeping Computer
