Researchers found the platforms actively communicating with sites built on rival kits Kali365 and EvilTokens, suggesting criminals are combining tools rather than competing for the same customers.

 

What happened

Researchers have identified two new phishing toolkits, Jalisco and OmegaLord, adding to a rapidly growing marketplace of tools built to steal Microsoft Entra authentication tokens and bypass multi-factor authentication. According to BankInfoSecurity, researchers found evidence that Jalisco is highly likely communicating with phishing sites created by both EvilTokens and Kali365, two previously documented device code phishing platforms, suggesting criminals are using these tools in combination rather than as competing standalone products. Jalisco is built to simplify stealing device authentication codes through a legitimate Microsoft Entra feature originally designed to let devices with limited input capabilities, such as printers and smart TVs, register and gain access using a short code entered in a browser. OmegaLord functions as a credential stealer that harvests usernames, passwords, and phone numbers, the last of which is likely intended to help intercept multi-factor authentication codes sent by text message.

 

Going deeper

Researchers who examined the control panels behind both platforms found they had accumulated victims largely based in the United States across a wide range of industries and job roles. The attack mechanics follow a consistent pattern across these tools, once a target lands on the phishing page, a script uses the legitimate Microsoft authentication process to request a device code, copies that code to the victim's clipboard, and sends the victim to a genuine Microsoft login page while routing their traffic through an attacker-controlled server. When the victim completes authentication, the script alerts the attacker, who now holds a working access token without ever seeing the victim's password. Requesting the device code only once the target reaches the phishing page matters because the code expires after 15 minutes unless authentication happens first, giving the attacker a narrow but reliable window to complete the theft. Microsoft has observed attackers generating a primary refresh token, which grants long-term persistent access, within minutes of a successful attack, while in other cases, attackers wait several hours before creating malicious inbox rules or pulling sensitive email data, likely to avoid triggering immediate detection.

 

What was said

Researchers told BankInfoSecurity that "because credentials are never exposed, traditional controls such as password resets and credential monitoring provide no relief, leaving defenders without the indicators they rely on to detect or contain account compromise." Microsoft stated that the latest device code phishing lures are sophisticated, typically involving a malicious attachment or link designed to pressure the target into acting quickly, with victims often routed through multiple layers of legitimate-looking infrastructure, including Vercel, Cloudflare Workers, and AWS Lambda domains before reaching the actual phishing page.

 

In the know

Kali365, the platform that prompted an FBI warning in May 2026, is also being distributed under the names Octopi365 and Freedom365. According to BleepingComputer's coverage of the FBI advisory, researchers assessed the renaming as likely stemming from rebranding, kit theft, or other operator activity, and noted that device code phishing is currently experiencing significant growth across the criminal marketplace. The Cloud Security Alliance issued a security advisory in May recommending that organizations using Entra, Okta, and Google Workspace prioritize phishing-resistant authentication for high-risk populations, including executives, system administrators, and anyone overseeing AI agent deployments, and configure Conditional Access policies to require stronger authentication specifically in privileged and high-value contexts.

 

The big picture

The growing number of competing and complementary device code phishing platforms signals that this technique has moved past being a single group's specialty into a standard commodity available to a wide range of criminal operators. For healthcare organizations, the defensive gap researchers described is particularly consequential. Because device code phishing never exposes a victim's actual password, the standard incident response playbook of resetting credentials and monitoring for password reuse does not protect once an attacker holds a valid token. According to Microsoft's own guidance on device code phishing risk, the company classifies device code authentication as a high-risk method and recommends blocking it entirely except where specifically needed, a stance that shows how difficult this category of attack has become to detect using conventional security tools once it succeeds.

 

FAQs

Why does stealing a device code bypass multi-factor authentication entirely?

The victim completes a completely genuine Microsoft login, including their normal multi-factor authentication step, because the attacker is not asking for a password at all. The attacker's script only needs the victim to approve the specific device code it generated in advance, and once that approval happens, Microsoft issues a valid access token directly to the attacker's waiting session.

 

Why does it matter that Jalisco appears to communicate with sites built using rival platforms like EvilTokens and Kali365?

It suggests the underlying infrastructure and techniques behind these tools are becoming interoperable, with criminal operators potentially mixing components from different platforms rather than being locked into a single vendor's ecosystem. That kind of cross-compatibility makes the overall device code phishing threat harder to track and disrupt, since taking down one platform's infrastructure may not affect campaigns built using a combination of tools.

 

What is a primary refresh token, and why is it so valuable to an attacker?

A primary refresh token is a credential that supports Microsoft's single sign-on feature, allowing continued access across multiple connected services without repeated logins. An attacker who obtains one gains long-term persistent access to a victim's account and connected applications, meaning the compromise can continue well beyond the initial phishing interaction.

 

Why do some attackers wait several hours before taking further action after stealing a token?

Immediate, aggressive activity right after a compromise, such as instantly creating inbox rules or downloading large volumes of email, can trigger automated security alerts that flag unusual account behavior. Waiting several hours allows the attacker's actions to blend in more naturally with the account's normal usage patterns, reducing the chance that a security team notices the compromise quickly.

 

What is the single most effective control against device code phishing, according to Microsoft's own guidance?

Microsoft recommends configuring Conditional Access policies in Entra to block the device code authentication flow entirely except in the specific, limited cases where an organization genuinely needs it for input-constrained devices like printers or conference room systems. Restricting the flow removes the underlying mechanism these attacks depend on, regardless of how convincing the phishing lure or redirect chain is designed to be.