Jalisco

Once inside a compromised Microsoft 365 account, attackers establish persistence by pairing multiple attacker-controlled devices to the victim's Entra ID tenant, then move quickly to exfiltrate sensitive data from software-as-a-service (SaaS) platforms for extortion.

Researchers at ReliaQuest are tracking two new phishing toolkits that are designed to bypass multifactor authentication (MFA).

Once inside a compromised Microsoft 365 account, attackers establish persistence by pairing multiple attacker-controlled devices to the victim's Entra ID tenant, then move quickly to exfiltrate sensitive data from software-as-a-service (SaaS) platforms for extortion.

ReliaQuest said it has recently observed threat actors registering more than five devices to a single compromised Microsoft Entra ID account, often using names resembling legitimate Windows or Microsoft devices to avoid drawing attention.

Once inside a compromised Microsoft 365 account, attackers establish persistence by pairing multiple attacker-controlled devices to the victim's Entra ID tenant, then move quickly to exfiltrate sensitive data from software-as-a-service (SaaS) platforms for extortion.

ReliaQuest said it has recently observed threat actors registering more than five devices to a single compromised Microsoft Entra ID account, often using names resembling legitimate Windows or Microsoft devices to avoid drawing attention.

often using names resembling legitimate Windows or Microsoft devices to avoid drawing attention.

Once inside a compromised Microsoft 365 account, attackers establish persistence by pairing multiple attacker-controlled devices to the victim's Entra ID tenant, then move quickly to exfiltrate sensitive data from software-as-a-service (SaaS) platforms for extortion.

Jalisco is a device code phishing toolkit that provisions fresh OAuth codes in real time via a backend API and manages captured sessions through a web portal.

Both of these toolkits indicate that attackers are increasingly interested in automating techniques to bypass MFA.

In the background, the attacker's tool silently collects the resulting access and refresh tokens from Microsoft's token endpoint, granting persistent account access without ever possessing the target's credentials.

After compromising an account, attackers search SharePoint and other SaaS services for valuable data and exfiltrate it within a few minutes, then follow up with extortion demands and threaten to leak it.

Both of these toolkits indicate that attackers are increasingly interested in automating techniques to bypass MFA.

Threat actors use compromised accounts to access sensitive data, such as customer or employee personally identifiable information (PII), financial records, and internal communications stored in SharePoint and other SaaS platforms.