As reported by BleepingComputer, two newly identified phishing kits — Jalisco and OmegaLord — are actively targeting Microsoft 365 accounts and successfully defeating multi-factor authentication protections. This development is not simply another phishing story. It represents a continued maturation of the Adversary-in-the-Middle (AiTM) threat model, and it should force every security team to honestly reassess whether their current identity protections are fit for purpose.

Key Takeaway: As reported by BleepingComputer, two newly identified phishing kits — Jalisco and OmegaLord — are actively targeting Microsoft 365 accounts and successfully defeating multi-factor authentication protections.

Why This Is a Watershed Moment for MFA Confidence

For years, security awareness campaigns and compliance frameworks have promoted MFA as the single most impactful control an organization can implement. That message isn't wrong — but it is dangerously incomplete. AiTM phishing kits don't break MFA cryptographically. Instead, they proxy the authentication flow in real time, harvesting session cookies after the victim has already authenticated, including completing their MFA challenge. The attacker then replays those cookies to gain authenticated access — effectively inheriting a fully validated session.

What makes Jalisco and OmegaLord particularly concerning is their apparent accessibility and deployment readiness. When sophisticated bypass techniques become commoditized into easy-to-deploy kits, the threat is no longer limited to well-resourced nation-state actors or elite criminal groups. It becomes available to mid-tier threat actors and opportunistic criminals, dramatically expanding the attack surface for organizations of all sizes.

Who Is Most Exposed

Why This Is a Watershed Moment for MFA Confidence
Microsoft 365-dependent organizations — any business using M365 for email, Teams, SharePoint, or OneDrive is squarely in scope
Organizations relying solely on push-based or TOTP MFA — these forms of MFA are the most susceptible to AiTM session hijacking
SMBs and mid-market companies — often lack advanced identity threat detection tools that would surface anomalous session behavior
Finance, legal, and healthcare sectors — high-value targets where account takeover quickly translates to business email compromise (BEC), fraud, or data exfiltration
Remote and hybrid workforces — distributed users clicking links across varied networks are harder to baseline for behavioral anomalies

The Broader Strategic Implication

This threat crystallizes something the security community has known but struggled to operationalize: authentication is not the same as identity assurance. A stolen session cookie is indistinguishable from a legitimate one at the authentication layer. The control gap is not in MFA itself — it's in the assumption that a successfully authenticated session is inherently trustworthy for its entire lifetime.

MFA remains essential — but it must be paired with continuous session validation, device trust, and behavioral analytics. Treating MFA as a terminal control, rather than one layer in a defense-in-depth stack, is a misconfiguration of your security architecture, not just your technology.

Organizations still operating on a "verify once at login" model are structurally vulnerable to this class of attack. Zero Trust principles — particularly continuous verification and least-privilege access — exist precisely to address this gap, and the emergence of kits like Jalisco and OmegaLord underscores the urgency of moving from Zero Trust as a concept to Zero Trust as an operational reality.

Shield53 Recommendations

Immediate Actions

  • Deploy FIDO2 / Passkey-based authentication — Phishing-resistant MFA methods (hardware security keys, Windows Hello for Business, Passkeys) are the only MFA forms that structurally resist AiTM attacks because credentials are bound to the legitimate origin domain
  • Enable Microsoft Entra ID Conditional Access with token protection — Token binding reduces the portability and replay value of stolen session tokens
  • Activate sign-in risk policies in Entra ID Protection — Configure policies to challenge or block sessions exhibiting anomalous properties such as impossible travel, unfamiliar locations, or atypical device fingerprints
  • Audit session lifetimes and refresh token policies — Shorter-lived tokens reduce the window of exploitation after a cookie is stolen
  • Implement Continuous Access Evaluation (CAE) — CAE in Microsoft 365 enables near-real-time revocation of access when risk signals are detected, rather than waiting for token expiry

Detection and Hunting Guidance

  • Hunt for sign-ins from unexpected geographies or ASNs following successful MFA completions
  • Alert on mailbox rule creation, forwarding configuration changes, or OAuth app consent grants immediately post-authentication — hallmarks of BEC follow-on activity
  • Correlate Microsoft 365 Unified Audit Log entries against endpoint telemetry — a sign-in with no corresponding endpoint activity can indicate session cookie replay
  • Monitor for use of anonymizing infrastructure (VPNs, residential proxies, Tor exit nodes) in authentication logs

User Awareness

  • Train users to verify URLs at the browser address bar level before entering credentials — AiTM kits rely on convincing lookalike domains
  • Emphasize that completing an MFA prompt for a request they did not initiate is a high-confidence indicator of active attack

The arrival of commoditized AiTM kits like Jalisco and OmegaLord should serve as a forcing function for security leaders to accelerate phishing-resistant authentication rollouts and invest in identity threat detection capabilities. The question is no longer whether your MFA can be bypassed — for most organizations today, it can. The question is whether your detection and response posture is fast enough to catch it when it happens.