Jalisco and OmegaLord: phishing kits built around device-code abuse

ReliaQuest researchers documented two phishing kits aimed at Microsoft 365. Jalisco is the more interesting one. It abuses the OAuth 2.0 device authorization grant, the flow built for devices that cannot show a browser, tricking victims into authorising an attacker-controlled device. Microsoft's codes are valid for 15 minutes, so the kit generates fresh ones in real time to keep the lure live, and ships an operator management portal. It can register several rogue devices on a compromised account under innocuous names.

OmegaLord is more conventional: fake PDF-reader login pages harvesting email addresses, passwords, and phone numbers, the last specifically to help work around MFA. After access, operators search SharePoint and connected SaaS for personal data, financial records, and internal communications.

Why it matters

Device-code phishing keeps working because the flow is legitimate and the consent screen looks correct. The victim sees a genuine Microsoft prompt asking them to approve a sign-in, because it is one. What they cannot see is that the device being approved is not theirs.

The mitigations are configuration rather than training, which makes them worth doing first. Block device code authentication in Conditional Access unless something in your estate genuinely needs it, and confirm what does before assuming. Cut the Entra ID device-registration limit from the default 50 to one or two, which removes the rogue-device persistence Jalisco relies on. Audit app registrations and delete what nobody owns. Then treat registered devices as an inventory you review, because a stealthily enrolled device is the same durable foothold as the passkey-enrollment campaign achieved by a different route. Our MFA guide covers what actually resists this.

Source: BleepingComputer