How the New Wave of MFA-Bypass Phishing Kits Actually Works

Security researchers have documented a sharp escalation in phishing-as-a-service (PhaaS) platforms and kits specifically engineered to bypass multi-factor authentication (MFA) on Microsoft 365 accounts. Rather than breaking cryptographic MFA flows, these attacks hijack the legitimate authentication process itself — intercepting session tokens, abusing OAuth device-code flows, or proxying real logins so the victim's own MFA approval works in the attacker's favor ^TCR.

Key Threats and Techniques

1. Forg365 — AI-Driven PhaaS Platform

First disclosed July 9, 2026 by ZeroBEC and BleepingComputer, Forg365 is a subscription-based ($400/month) PhaaS platform distributed via Telegram ^CC. It bundles three breakthrough capabilities:

• AI-assisted lure generation: The dashboard uses generative AI to automatically draft, refine, and localize phishing emails targeting specific industries and business scenarios — drastically lowering the skill barrier ^TR.
• Dual-path MFA bypass: Forg365 executes both adversary-in-the-middle (AiTM) proxying (relaying real login sessions through attacker infrastructure) and OAuth device-code phishing (tricking victims into entering an attacker-supplied code at microsoft.com/devicelogin, which authorizes the attacker's client) ^SC.
• Antibot evasion and post-compromise operations: The platform includes antibot measures and tools for automated mailbox operations after account takeover ^C.

2. ForgCookie Browser Extension — Persistent Access

A companion browser extension, ForgCookie, is compatible with Chrome, Edge, and Brave ^C. Once the victim's session tokens or cookies are harvested, ForgCookie automatically refreshes stolen session cookies, allowing the attacker to maintain access to Microsoft 365 services (Outlook, Teams, OneDrive, SharePoint) without re-authentication — even after the victim changes their password ^IC. This turns a one-time token grab into persistent, long-term compromise.

3. Jalisco — Device-Code Phishing Toolkit

Disclosed by ReliaQuest and BleepingComputer on July 14, 2026, Jalisco is a device-code phishing kit actively used against Microsoft 365 accounts ^RS. It works by:

• Sending emails that direct the victim to enter a device code at Microsoft's legitimate login page.
• The code belongs to an attacker-controlled OAuth application.
• The victim completes real MFA on Microsoft's own servers — but the resulting OAuth tokens are issued to the attacker's polling client, not the victim ^RS.

This means MFA is not "broken" — it is weaponized.

4. OmegaLord — Fake PDF Reader Credential Harvester

Also reported July 14, 2026, OmegaLord takes a different approach: it masquerades as a fake PDF reader browser page ^RS. When victims land on the page:

• They are prompted to "log in to view this secured document."
• The login form captures credentials and associated one-time password (OTP) codes in real time.
• Attackers use the stolen credentials + OTP to authenticate immediately, before the OTP expires ^RS.

5. Broader OAuth Spoofing and Device-Code Surge

Multiple sources confirm a broader industry trend:

• Microsoft documented OAuth redirection abuse against government and public-sector organizations in March 2026, using silent OAuth flows and invalid scopes ^M.
• Device-code phishing kits including Kali365, EvilTokens, Ghost Hub, Cyb3r, and Tycoon2FA have all been observed actively targeting Microsoft 365 in 2026, with May 2026 being a peak month ^SB.
• The FBI issued a Public Service Announcement (PSA I-052126) in May 2026 specifically warning about Kali365, a PhaaS platform that hijacks M365 accounts without passwords by abusing the OAuth device authorization grant flow ^I.

How MFA Bypass Actually Works

The critical insight across all these threats is that MFA is not technically defeated — it is co-opted:

Technique	What Happens	Why MFA Doesn't Stop It
Device-code phishing	Victim enters attacker's code at Microsoft's real login page, completes their own MFA	The token goes to the attacker's app. MFA approved the right user — for the wrong client.
AiTM proxying	Victim logs in through attacker's proxy, MFA completes normally	Attacker captures the session cookie in real time and hijacks the session.
Credential + OTP harvesting	Fake login form captures password and OTP simultaneously	OTP is used immediately by the attacker before it expires.

This is why traditional MFA alone is no longer sufficient defense ^TWS.

Researcher Security Recommendations

Based on multiple advisories, the following mitigations are strongly recommended:

• Disable OAuth device-code flows for your tenant if your organization does not use them (e.g., via Conditional Access policies to block devicecode authentication).
• Enforce Conditional Access policies that require compliant devices, trusted locations, and session risk checks — not just MFA.
• Monitor for anomalous OAuth application grants — especially apps requesting offline_access, Mail.Read, or Files.ReadWrite.All permissions.
• Block legacy authentication and require modern authentication with token-binding where possible.
• Use token protection / token binding (Microsoft's "token theft protection" features) to tie tokens to specific devices.
• Deploy phishing-resistant MFA (FIDO2 security keys or Windows Hello for Business) that cannot be proxied.
• Train users to recognize device-code phishing lures that ask them to "enter this code to verify your account" on legitimate Microsoft URLs.
• Audit sign-in logs for authentication from unexpected IPs, unusual user agents, and device-code logins from non-corporate devices.

These recommendations are drawn from the FBI PSA ^I, Microsoft Security Blog ^M, BleepingComputer ^RC, and ReliaQuest threat analysis ^S.

Summary

The 2026 wave of Microsoft 365 phishing — led by Forg365 (with its ForgCookie persistence extension), Jalisco, OmegaLord, and the broader ecosystem of device-code and AiTM kits — represents a paradigm shift. Attackers no longer need to steal passwords or break MFA. Instead, they abuse the OAuth trust model to make the victim's own authentication authorize an attacker-controlled session. The security community's consensus recommendation is a zero-trust posture: disable unused auth flows, enforce Conditional Access, monitor token grants, and move toward phishing-resistant MFA ^ICSC.