SkyW4lker is a phishing kit that targets Microsoft 365 users, primarily in the United States and Europe. It abuses Microsoft's device-code authentication flow to gain access to corporate accounts without stealing passwords or bypassing MFA. The kit uses password-protected email attachments containing links that lead victims through CAPTCHA challenges to Microsoft's legitimate authentication system. Activity increased notably between June and October 2026, with the US accounting for nearly half of the observed submissions. The kit shares infrastructure and code with the Gabagool phishing kit, indicating a common threat actor.
MadApe is a sophisticated multi-stage phishing campaign targeting Microsoft Device Code authentication. It uses business-themed PDF lures, configurable redirect chains, and fake document-sharing pages impersonating services like SharePoint, OneDrive, Teams, Adobe Acrobat, and DocuSign. The campaign abuses Microsoft's Device Code flow to access victim accounts without credential theft on phishing pages. It features extensive infrastructure with 155 domains, human-verification challenges, decoy sites, and exposed operator panels. The campaign is localized in at least nine languages and focuses on business communications.
SkyW4lker is a phishing kit active since June 2026 that targets Microsoft 365 authentication by exploiting OAuth 2.0 device-code flows to bypass MFA. It uses password-protected email attachments leading victims through CAPTCHA pages to malicious sites requesting device codes. The kit primarily targets US firms, especially in technology, manufacturing, and government sectors, and shares infrastructure with the Gabagool phishing kit.
Between July and September 2026, a sophisticated campaign targeted Microsoft 365 accounts using adversary-in-the-middle attacks and token replay techniques. Attackers captured sign-in sessions via AiTM relays and replayed stolen tokens from IP addresses linked to a German hosting provider. The campaign compromised 79 organizations with 497 successful sign-ins amid over 200,000 failed attempts. Malicious actors registered rogue Entra devices, replaced victim MFA methods, and created hidden inbox rules to conceal their activities. The operation evolved through four phases, rotating IP addresses and employing scripted token and browser session replay techniques. Compromised accounts were used for business email compromise, including sending payroll-related emails to external contacts.
Wazza is a multi-stage phishing kit actively targeting Microsoft 365 accounts since July 2026. It uses phishing emails with PDF lures themed around business documents to redirect victims through a complex infrastructure involving Google Sites and CloudFlare Workers. The kit impersonates multiple well-known services and employs advanced browser checks and client-side protections. It abuses Microsoft OAuth device authorization to trick victims into completing authentication, allowing attackers to gain access to accounts and cloud resources. The campaign is medium severity due to credential theft risks.
A widespread IT impersonation and voice-phishing campaign designated PREY-0058 is actively targeting Microsoft 365 and SaaS platforms. Threat actors impersonate IT helpdesk staff via phone or text to trick executives and senior personnel into divulging credentials through adversary-in-the-middle phishing portals. After bypassing multi-factor authentication, attackers conduct rapid automated data exfiltration across email, file storage, and cloud repositories without deploying ransomware. The operation relies heavily on NodeMaven residential proxy infrastructure to blend with legitimate traffic. Extortion demands are delivered via TOX messaging within hours of compromise, typically with 72-hour deadlines and threats of public data exposure. The campaign exhibits tradecraft overlapping with UNC6671 and involves multiple extortionware brands including BlackFile, Redact, Pink, and Helix.
BigBear 2.0 is a phishing-as-a-service campaign leveraging Evilginx2 to target Microsoft 365 credentials worldwide. It uses adversary-in-the-middle techniques combined with geo-matched residential proxies to bypass multi-factor authentication, including disabling FIDO2/WebAuthn MFA. The campaign has exfiltrated thousands of credentials and session cookies, impacting over 3,300 unique victim IPs across more than 40 countries. The platform is operated by an entity known as 'General Boss' and leased to multiple affiliates. It automates cookie replay and real-time data exfiltration via Telegram.
Mirage2FA is an active phishing-as-a-service toolkit built to steal Microsoft 365 credentials and authenticated sessions through Adversary-in-the-Middle attacks. Analysis shows 63.7% of identified victims are in the US, with Technology, Manufacturing, and Education among the most targeted industries. The operation generated thousands of compromise events between 2024 and 2026, including stolen session cookies, passwords, and SSO access. Once a Microsoft 365 session is hijacked, attackers gain access to corporate email, sensitive data, and trusted business accounts. The toolkit uses browser-based delivery through .htm, .xhtml, and .svg stagers, QR codes, JavaScript obfuscation, and WebSocket-based AiTM activity. Of 9,426 unique targeted email addresses, 4,532 were potentially compromised, representing approximately 48% success rate.
Phishing attacks have surged in 2026 as AI-powered phishing-as-a-service kits enable threat actors to bypass multi-factor authentication and harvest OAuth tokens at scale. Two phishing tools were identified in active campaigns: Jalisco, a device code phishing toolkit that provisions fresh OAuth codes in real time to defeat time-based security controls, and OmegaLord, a credential harvester that captures phone numbers alongside passwords to intercept MFA. Both tools demonstrate that attackers are engineering sophisticated methods to defeat authentication controls. These toolkits are part of a broader ecosystem that includes AI-powered PhaaS kits like EvilTokens and Kali365, which leverage legitimate cloud platforms to evade detection. Following compromise, attackers establish persistence by enrolling multiple devices to victim Entra ID tenants, enabling access that survives password resets and extends the window for data exfiltration and extortion.
Kratos is a mature Phishing-as-a-Service operation targeting Microsoft 365 users across the United States, Europe, and other regions. The platform enables attackers to steal credentials through trusted platforms, anti-bot verification, and convincing login pages. Researchers traced three generations of the kit and uncovered 1,484 previously unattributed detonations. The operation targets organizations across more than 20 countries with particularly strong concentration in the US, Spain, and Southern Europe. Kratos includes an operator panel allowing deployment of phishing domains, configurable Telegram or email delivery, geographic restrictions, and multiple anti-bot systems. The kit has evolved through three page generations (V0, V1, V2) with different exfiltration code. Activity has been visible since January 2026, with the operator panel active since September 2025.
An advanced voicemail-themed phishing campaign is utilizing HTML attachments to hijack Microsoft 365 sessions through silent OAuth exploitation. Emails arrive spoofing legitimate businesses with fake voicemail notifications containing embedded HTML files. When victims click the play button, the kit triggers a rogue OAuth 2.0 request using the prompt=none parameter to steal authentication tokens from active M365 sessions. If no active session exists, victims are redirected to credential harvesters hosted on compromised infrastructure, specifically a Turkish domain hosting over 100 active campaign directories. The operation includes multiple attack vectors: fake login portals mimicking DocuSign, Outlook and Google, OAuth device code phishing interfaces, and RMM deployment disguised as document viewers. This represents a sophisticated Phishing-as-a-Service operation deploying concurrent attack types from consolidated infrastructure.
Device code phishing attacks have exploded across the threat landscape, with new toolkits emerging weekly. This surge coincides with publicly released criminal toolkits and multiple phishing-as-a-service offerings like EvilTokens and Tycoon. Threat actors abuse the OAuth 2.0 device authorization grant flow to compromise Microsoft 365 and other enterprise accounts by tricking users into authorizing malicious applications. Current implementations use on-demand code generation, addressing the 15-minute expiration limitation of previous techniques. Most activity appears to be generated using AI-based coding techniques. Successful attacks lead to full account takeover, data theft, business email compromise, and potential ransomware deployment. The technique represents the natural evolution of credential phishing as organizations improve their defenses against traditional multifactor authentication bypass methods.
In early April 2026, a large-scale device code phishing campaign targeted organizations across multiple sectors and regions, exploiting OAuth 2.0 Device Authorization Grant. Threat actors leveraged the Kali365 phishing-as-a-service platform, originating primarily from IP address 216.203.20[.]95. The campaign used high-fidelity lures directing victims to Microsoft's legitimate device login flow, where users unknowingly authorized threat actor-controlled sessions. Captured OAuth tokens enabled immediate mailbox access and post-compromise activities. In some cases, attackers established malicious inbox rules to suppress security notifications, extending dwell time. The Kali365 platform operates as a multi-tenant PhaaS ecosystem supporting both device code abuse and adversary-in-the-middle session capture, featuring rapid lure generation across multiple languages and file types, Cloudflare Worker-hosted pages, and token sharing capabilities between affiliates.
EvilTokens is a new Phishing-as-a-Service offering a turnkey Microsoft device code phishing kit. It enables attackers to harvest access and refresh tokens, granting unauthorized access to victims' Microsoft accounts. The kit supports post-compromise operations, allowing data exfiltration from various Microsoft services. EvilTokens has been rapidly adopted by cybercriminals since March 2026, impacting organizations globally. The service provides advanced capabilities for account takeover, including token conversion to Primary Refresh Tokens and browser cookies for persistent access. Phishing campaigns using EvilTokens target employees in finance, HR, logistics, and sales, primarily for Business Email Compromise attacks.
A new phishing technique abusing Microsoft's OAuth Device Code flow is on the rise, with over 180 phishing URLs detected in a week. This method shifts from credential theft to token-based account takeover, making detection more challenging. Attackers initiate a device authorization process, tricking victims into approving it on legitimate Microsoft pages. The attack uses encrypted HTTPS traffic and legitimate authentication flows, bypassing traditional phishing indicators. Victims unknowingly grant attackers access to their Microsoft 365 accounts through OAuth tokens. This poses a critical risk as it allows immediate access to corporate data and resources, potentially leading to business email compromise and persistent access through refresh tokens.
A sophisticated adversary-in-the-middle phishing campaign targets Microsoft 365 and Okta users by exploiting single sign-on (SSO) flows. Attackers use lookalike domains and malicious JavaScript injections to steal credentials and session tokens, bypassing multi-factor authentication. Initial access is gained through phishing emails themed around compensation and benefits, sent via compromised mailboxes and Amazon SES. The phishing infrastructure is hosted on Cloudflare, enhancing resilience and evasion. This campaign specifically targets organizations relying on Okta as an identity provider for Microsoft 365, enabling session hijacking and credential theft. The threat poses a medium severity risk due to its complexity and potential impact on confidentiality and integrity. European organizations using these platforms are at risk, especially in countries with high adoption of Microsoft 365 and Okta. Mitigation requires targeted user training, domain monitoring, and enhanced detection of anomalous authentication flows. No CVSS score is available; however, the threat is assessed as high severity given the bypass of MFA and session hijacking capabilities.
The Jingle Thief campaign, conducted by financially motivated threat actors from Morocco, targets global enterprises in retail and consumer services sectors to execute gift card fraud. Using phishing and smishing tactics, the attackers gain access to Microsoft 365 environments, exploiting cloud services for reconnaissance, lateral movement, and persistence. They focus on compromising gift card issuance systems, leveraging internal documentation and communication channels. The campaign demonstrates sophisticated techniques, including tailored phishing, internal email manipulation, and device registration abuse. The attackers maintain long-term access, sometimes over a year, making detection challenging. Their activities often align with holiday periods to maximize impact.
Tykit is a newly identified phishing kit targeting Microsoft 365 accounts, active since May 2025. It uses SVG files as delivery vectors and a multi-stage attack chain to mimic Microsoft login pages and steal credentials. The kit employs evasion techniques including Cloudflare Turnstile anti-bot protection and basic anti-debugging measures. It primarily targets industries such as finance, construction, IT, professional services, government, and telecom, with victims globally including the EMEA region. Stolen credentials are exfiltrated via API calls to attacker-controlled servers. The campaign requires user interaction through phishing but does not require prior authentication. This threat poses a medium severity risk due to its potential impact on confidentiality and the widespread use of Microsoft 365 in Europe.
Threat actors are actively exploiting Microsoft 365's Direct Send feature to deliver phishing emails, bypassing perimeter security solutions by routing malicious messages through trusted infrastructure. This technique requires no credentials, only knowledge of the target domain and valid recipient addresses. The attack process involves identifying organizational domains, crafting emails impersonating internal users, and delivering them through Microsoft 365's infrastructure. Recent campaigns have successfully harvested credentials and established footholds within targeted environments. Attackers use automated tools to generate convincing business-themed lures, often utilizing PDF and DOCX attachments with QR codes or obfuscated HTML leading to phishing pages. The abuse of Direct Send represents a critical gap in email security defenses, particularly for organizations relying heavily on email communications.
Proofpoint has uncovered a sophisticated phishing campaign utilizing fake Microsoft OAuth applications to bypass multifactor authentication and steal credentials. The threat actors impersonate various enterprise apps like RingCentral, SharePoint, Adobe, and DocuSign to lure victims. The attack chain involves OAuth app creation, redirects to malicious URLs, and the use of attacker-in-the-middle phishing kits, predominantly Tycoon. This technique has been observed in email campaigns with over 50 impersonated applications, targeting multiple industries. The campaign's goal is to gain access to Microsoft 365 accounts, potentially for information gathering, lateral movement, malware installation, or further phishing attacks.
