New Phishing Kits Bypass MFA to Compromise Microsoft 365 Accounts
What Happened — Researchers uncovered two phishing kits, Jalisco and OmegaLord, that trick Microsoft 365 users into authorizing attacker‑controlled devices via the OAuth 2.0 device‑code flow or by harvesting credentials and phone numbers through a fake PDF‑reader login page. Both toolkits enable attackers to bypass multi‑factor authentication (MFA) and harvest data from SharePoint, OneDrive, and other SaaS services within minutes.
Why It Matters for Compliance & Audit Readiness
- MFA bypass attacks illustrate a gap in the SOC 2 Access Controls (CC6.1) that require strong authentication and continuous monitoring of privileged access.
- Successful phishing exploits highlight the need for documented Security Awareness Training and evidence that users can recognize and report credential‑phishing attempts.
- Rapid data exfiltration underscores the importance of audit‑ready logging (CC7.1) and incident‑response evidence to demonstrate timely detection and containment.
Who Is Affected — Enterprises across technology, finance, healthcare, and any sector that relies on Microsoft 365 for email, collaboration, and file storage.
Recommended Actions
- Map the MFA bypass scenario to SOC 2 CC6.1 and CC7.1 controls; verify that conditional‑access policies enforce phishing‑resistant authentication (e.g., FIDO2, Windows Hello).
- Deploy and regularly test Security Awareness Training that includes device‑code phishing simulations.
- Enable detailed logging of OAuth device‑code grants and monitor for anomalous device registrations.
- Capture evidence of policy enforcement and training completion for audit readiness.
Source: BleepingComputer
Technical Notes — Jalisco automates OAuth device‑code generation, bypassing the 15‑minute validity window; OmegaLord harvests phone numbers to intercept MFA codes. Both rely on social engineering rather than software vulnerabilities. Source: same article