Executive Summary
In early 2026, a significant surge in sophisticated phishing campaigns was observed, driven by AI-powered Phishing-as-a-Service (PhaaS) ecosystems. The 'Jalisco' toolkit represents a maturing capability in device code phishing, utilizing 'lure-generation' via real-time APIs to bypass traditional 15-minute Time-To-Live (TTL) security controls. By tricking users into authenticating via legitimate Microsoft portals, attackers harvest OAuth tokens to gain persistent access that survives password resets.
Technical analysis also identified 'OmegaLord,' a JavaScript-based credential harvester designed to collect phone numbers alongside credentials to facilitate MFA interception. Attackers are further entrenching themselves by enrolling multiple malicious devices (often five or more) into victim tenants, leveraging legitimate-looking naming conventions to blend in. This shift from credential theft to session and token exploitation significantly complicates incident response and eviction efforts.
This trend highlights a critical evolution where attackers target the authentication process directly. The use of legitimate developer platforms such as workers[.]dev and edgeone[.]app for hosting infrastructure allows these campaigns to evade traditional email gateways and signature-based detection, posing a high risk to organizations relying on legacy MFA methods.