This threat involves AI-enhanced phishing toolkits such as Jalisco and OmegaLord that enable attackers to bypass MFA and harvest OAuth tokens at scale. Jalisco provisions fresh OAuth device codes in real time, defeating time-based security controls, while OmegaLord harvests credentials including phone numbers to intercept MFA challenges. These toolkits are components of a broader phishing-as-a-service ecosystem that leverages legitimate cloud platforms to evade detection. Post-compromise, attackers maintain persistence by enrolling multiple devices in victim Entra ID tenants, allowing access that survives password resets and facilitates prolonged data exfiltration and extortion campaigns.

The threat enables attackers to bypass multi-factor authentication and harvest OAuth tokens, compromising account security in Microsoft 365 and related cloud environments. Persistence mechanisms allow attackers to maintain access even after password resets, increasing the risk of extended data exfiltration and potential extortion. The use of legitimate cloud platforms for phishing operations complicates detection and response efforts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Organizations should monitor for indicators of compromise such as suspicious OAuth token activity and device enrollments in Entra ID tenants. Implementing conditional access policies and continuous monitoring of authentication events may help detect and mitigate these attacks. Since this is a phishing-as-a-service threat leveraging cloud platforms, user education on phishing risks and verification of authentication requests remain important. No official fix or patch is currently indicated.