How the New Wave of MFA-Bypass Phishing Kits Actually Works

2. ForgCookie Browser Extension — Persistent Access

A companion browser extension, ForgCookie, is compatible with Chrome, Edge, and Brave . Once the victim's session tokens or cookies are harvested, ForgCookie automatically refreshes stolen session cookies, allowing the attacker to maintain access to Microsoft 365 services (Outlook, Teams, OneDrive, SharePoint) without re-authentication — even after the victim changes their password . This turns a one-time token grab into persistent, long-term compromise.

3. Jalisco — Device-Code Phishing Toolkit

Disclosed by ReliaQuest and BleepingComputer on July 14, 2026, Jalisco is a device-code phishing kit actively used against Microsoft 365 accounts . It works by:

• Sending emails that direct the victim to enter a device code at Microsoft's legitimate login page.
• The code belongs to an attacker-controlled OAuth application.
• The victim completes real MFA on Microsoft's own servers — but the resulting OAuth tokens are issued to the attacker's polling client, not the victim .

This means MFA is not "broken" — it is weaponized.

4. OmegaLord — Fake PDF Reader Credential Harvester

Also reported July 14, 2026, OmegaLord takes a different approach: it masquerades as a fake PDF reader browser page . When victims land on the page:

• They are prompted to "log in to view this secured document."
• The login form captures credentials and associated one-time password (OTP) codes in real time.
• Attackers use the stolen credentials + OTP to authenticate immediately, before the OTP expires .

5. Broader OAuth Spoofing and Device-Code Surge

Multiple sources confirm a broader industry trend:

• Microsoft documented OAuth redirection abuse against government and public-sector organizations in March 2026, using silent OAuth flows and invalid scopes .
• Device-code phishing kits including Kali365, EvilTokens, Ghost Hub, Cyb3r, and Tycoon2FA have all been observed actively targeting Microsoft 365 in 2026, with May 2026 being a peak month .
• The FBI issued a Public Service Announcement (PSA I-052126) in May 2026 specifically warning about Kali365, a PhaaS platform that hijacks M365 accounts without passwords by abusing the OAuth device authorization grant flow .

How MFA Bypass Actually Works

The critical insight across all these threats is that MFA is not technically defeated — it is co-opted:

This is why traditional MFA alone is no longer sufficient defense .

Researcher Security Recommendations

Based on multiple advisories, the following mitigations are strongly recommended:

• Disable OAuth device-code flows for your tenant if your organization does not use them (e.g., via Conditional Access policies to block devicecode authentication).
• Enforce Conditional Access policies that require compliant devices, trusted locations, and session risk checks — not just MFA.
• Monitor for anomalous OAuth application grants — especially apps requesting offline_access, Mail.Read, or Files.ReadWrite.All permissions.
• Block legacy authentication and require modern authentication with token-binding where possible.
• Use token protection / token binding (Microsoft's "token theft protection" features) to tie tokens to specific devices.
• Deploy phishing-resistant MFA (FIDO2 security keys or Windows Hello for Business) that cannot be proxied.
• Train users to recognize device-code phishing lures that ask them to "enter this code to verify your account" on legitimate Microsoft URLs.
• Audit sign-in logs for authentication from unexpected IPs, unusual user agents, and device-code logins from non-corporate devices.

These recommendations are drawn from the FBI PSA , Microsoft Security Blog , BleepingComputer , and ReliaQuest threat analysis .

Summary

The 2026 wave of Microsoft 365 phishing — led by Forg365 (with its ForgCookie persistence extension), Jalisco, OmegaLord, and the broader ecosystem of device-code and AiTM kits — represents a paradigm shift. Attackers no longer need to steal passwords or break MFA. Instead, they abuse the OAuth trust model to make the victim's own authentication authorize an attacker-controlled session. The security community's consensus recommendation is a zero-trust posture: disable unused auth flows, enforce Conditional Access, monitor token grants, and move toward phishing-resistant MFA .