# New phishing kits target Microsoft 365 accounts, evade MFA

> **Open Intelligence Dossier** · First detected: 2026-07-15 10:07 UTC · Category: Technology

## Executive Summary
New phishing kits including Kratos and Forg365 are targeting Microsoft 365 accounts by evading multi-factor authentication through advanced technical maneuvers.

## Intelligence Brief
A series of sophisticated phishing operations are currently targeting Microsoft 365 users. According to coverage from BleepingComputer and The National CIO Review, attackers have deployed new phishing kits specifically designed to evade multi-factor authentication (MFA). These operations include the use of the Kratos Phishing-as-a-Service (PhaaS) platform, which utilizes SharePoint links and Cloudflare Turnstile anti-bot checks to facilitate credential exfiltration. Additionally, the Forg365 PhaaS platform is targeting accounts through adversary-in-the-middle (AitM) session theft and device code abuse. Other reported methods involve the use of fake Microsoft Entra passkey enrollments to gain unauthorized access to corporate environments. Multiple security organizations and news outlets are tracking these developments.


BleepingComputer and The Hacker News highlight the emergence of these kits, while Okta has specifically warned of widespread vishing campaigns targeting Microsoft 365 customers. SecurityWeek further emphasizes the vishing threats detailed by Okta. Further technical analysis from cyberpress.org describes how Kratos employs obfuscated login pages and PHP endpoints for the exfiltration of sensitive credentials. Meanwhile, The Hacker News reported that a misconfigured server inadvertently revealed three separate Evilginx phishing operations that were actively targeting Microsoft 365 users. This trend is significant due to the high financial stakes and the persistence of the access gained. According to News4JAX, the FBI has issued a warning regarding the Kali365 phishing platform, and reports indicate that users in Florida have suffered losses totaling $12 million.


The technical nature of these attacks is particularly dangerous; gbhackers.com reports that attackers are abusing OAuth device codes and Entra ID enrollment to secure persistent access to Software-as-a-Service (SaaS) environments. CSO Online notes that tools like Forg365 are effectively lowering the barrier for entry, making account takeovers more accessible for less skilled attackers. Future developments will likely center on the mitigation of these specific phishing platforms. Coverage suggests that the focus remains on the abuse of Entra ID enrollment and the use of OAuth device codes for persistent access. Observers are monitoring the impact of the Kali365 platform following the FBI's warning and tracking the financial fallout in regions like Florida. The continued use of Cloudflare Turnstile by Kratos and the session theft capabilities of Forg365 indicate a trend toward bypassing traditional MFA, which means security professionals will need to watch for new indicators of compromise associated with AitM attacks.

## Multi-Source Evidence Table
| Source Outlet | Headline | Verification URL |
|---|---|---|
| cyberpress.org | Kratos Uses Cloudflare Turnstile, Obfuscated Login Pages, and PHP Endpoints to Exfiltrate Credentials | [Source Link](https://news.google.com/rss/articles/CBMib0FVX3lxTE03bDUxSlFjZ2lZSVdhSGYzaHFkVXRBQ2RhNXRPZEM5STYtdmdGcUxSZ0tNeGoteGo3VFR6TDhURGpWSW9tQkstTEZIWkxJamZwZHMyRThlQ3FDb3ViNTlwRi0zaEJZMm5aSlRvdzk5Yw?oc=5) |
| Cyber Daily | Hackers targeting Microsoft 365 in widespread vishing campaign, Okta warns | [Source Link](https://news.google.com/rss/articles/CBMitAFBVV95cUxOYURHQ1k0Q195OWpQYmdYWk9RbUg5Smt1NXpueHFlSENNcldya2xQZ1Nra3JmTTdpY1FXREptbzU0RTJqYTRDN1RQS1dFSE53bXc5V0doWmVCaV9IYTdhRl8tdTF3YVZ5WmxaNzFZU3hROFh4b1hqam5tTzZfYW1pMEJ4UUh4TTIwc1o3MmNBTGFmRmtBUFU3U0lsTUVCNTV4MERIMFd4NVVaa0JTdzVhS29hWXE?oc=5) |
| gbhackers.com | Kratos PhaaS Targets Microsoft 365 Users With SharePoint Links and Cloudflare Anti-Bot Checks | [Source Link](https://news.google.com/rss/articles/CBMiaEFVX3lxTE9vUm01LS0tTkpJMWVpX2lwSnJzYWtCLVZ0eENRTUJ3S2FDay1JSm5xeGZUU2xBZ3h3YVFrbm5lVUVnNXN1TGJIN1ZheGNfUVpxT1ktQnFWQlZ6UkVCMnZ0eGdEenBkZk9O0gFuQVVfeXFMTW4yeTVGajFqWG5oamdoYjRnS1dYeHZtelI4M0lkMlVSQkFZWVRVVHR5N3FRNW03Uk5RVl91elhoREc3NnRtNzlvdkpWNmlFX3dpZW5VNWhGa0hNcHZiekdtUXNNeHdvclIwVnEzaVE?oc=5) |
| The Hacker News | Misconfigured Server Reveals Three Evilginx Phishing Operations Targeting Microsoft 365 | [Source Link](https://news.google.com/rss/articles/CBMifkFVX3lxTE9YUk5lYkNBU1lxc2lDTXVpNFNPOHd5Q0p5WVZDQmxPWUlHYklSWlU1VGxubE9kR0xTN3QtZHQtdUtzekxWMUl6c19IdHdkWWUzbE14S1BUdjNkdU5BOE9jUW9OMzVpVGdOdGdVRHRqZXlBNVlnOUo5ZVpOcGJ2QQ?oc=5) |
| The National CIO Review | Attackers Find a New Way Into Microsoft 365 | [Source Link](https://news.google.com/rss/articles/CBMipwFBVV95cUxNT3Y4VFFPY2tQVDJRelF2dW5BT1ZmclhLeEFwSDI4dExmbHMyQ1lYNnhSTmNUc0FTNTcwOWQ0T085YVFWWlZENDhNejFtMzIxNjVZYjI4Z3Npazl2dXNBUG9xV3hQbDJSUS1iRkk0WU5zbnl5OXBwX3NxVFdNRkE2UzRrWHZYWE5ObmQ4c1hnUGw2NGd5NmYyaWZfSlJjdDYteUpUZGtIYw?oc=5) |
| BleepingComputer | New phishing kits target Microsoft 365 accounts, evade MFA | [Source Link](https://news.google.com/rss/articles/CBMiqAFBVV95cUxQbjRKc29ZQ3dVUTljVmVqUVZ6UFlxTmlTSFhseVlsNFBWdFlZelpEWm9mTU1HeGRwMHpqME5STHRzV1ZUN2I1TFYyUkxEMXFzQ3pUTzRvRV9NX0x1U0JPZmFXSW5UQXlZMVFGYjN3Z2FTUnZheUwweVZteThLOW1PTkVqLXdrQlhnemZ4R3VYUEV0eWc1R2trUWpqaU9yaXM1VW1pbjBzM1M?oc=5) |
| The Hacker News | Hackers Use Fake Microsoft Entra Passkey Enrollment to Gain Microsoft 365 Access | [Source Link](https://news.google.com/rss/articles/CBMie0FVX3lxTE8zdUFjeHVjWGUzenVGeW4xbi1LMENqd0FNaUl1amhsdEJRS3Zhc0hGSWZ4RjBwMmFITWozdU0wMV9oRzBNQVk4c2tldWlpb3ZRdGQ4V09ZWVB5cXR3Wm44X2xlTHZYOFFmY0JZMGdSZC14S3A3YWVsenpUVQ?oc=5) |
| News4JAX | FBI warns Kali365 phishing platform is targeting Microsoft 365 users; Floridians report $12 million in losses | [Source Link](https://news.google.com/rss/articles/CBMi6wFBVV95cUxPNnNBd3dPc1dBc0hNWkFLdVh2Tk1RUG1xM21YcnZyd29BQnBhekd6ZzZSYzhFLVRYbFB4QjFKNHhaS3MwMVhFRGs3bXZPZkxEU21MbWJBWEZPVndFTFFwM2theTVjOFRYVEtobDJqVHBJdEY4R2NGb3JSemFzMnB5bWl6QnRmM2o5cUM4RzN6RFh2dWdOZTZyNWotRnQ4d0hOOHNWMkZLRTZWV0JKRXVCcmlxbUdsUElRM0lYOEF3TzgxaFZNY1Q1SDZkV3VjLXZCOE5KZEs1eDUtVlVTcW5HODMyV2wxbC16VXlR?oc=5) |
| csoonline.com | Phishing for dummies: Forg365 lowers barrier to M365 account takeovers | [Source Link](https://news.google.com/rss/articles/CBMitwFBVV95cUxNYzFuT0ltbnVHc2Rkam9qc1lBTjBoQmdxVXB2azhrUEkyM3YtVVRwM1F6a2ZjNTZFSXZiMkVXUjlVT3lEUjVQYm9GanRzRWlRS1I1YlBLOTNQRExnQXJfUlQ3Ym4xUlBSRUVlcS04SnRYY1JUMkpZRzlnWlMzY1JrQUxfZG5ySWU1M1ZPNEVpcS05RlpZODVSdVZzMTRLWG9RUXQxSVNFQ2hsZHhLQXozay1uQm5aT1U?oc=5) |
| gbhackers.com | Hackers Abuse OAuth Device Codes and Entra ID Enrollment for Persistent SaaS Access | [Source Link](https://news.google.com/rss/articles/CBMibkFVX3lxTE5jS1RjMC1kYUlDOVJVeDI1T29MaWFINU9DOUt2MDVBMXp6WDQ2MElBeGFLRkExMVlQckwyVmxHUnFtYl9Fd3ZVQjBkZVg5UmtwNWp0dkVQWThhVjRmSmZzc0FzNzlWVmEwRnFkMU9B0gFzQVVfeXFMUERaRVZhVmVIbjFLeVMwby1mczI1amVVMENHTzZCWWpfZkppVnEzNDFzOGFvQ2lad3pIT0s4V250bDlYSU02WjUzQnZOTldNdWt6cDBYaVZwd2dUUXctdTVtdE1rM25La3R5dkk0R0g0S0dmTQ?oc=5) |
| SecurityWeek | Okta Warns of Vishing Attacks Targeting Microsoft 365 Customers | [Source Link](https://news.google.com/rss/articles/CBMimAFBVV95cUxOOXZsNzN6ajhTbVQwdGtTcTExbHU1Rlhma2MwQkZYeFRUQ3lPWU1rWGFzazdIUTJjLTBUazVTUzJzY1Q2aU85TVkwNDYyVHJJUk8yaExfdXFlZ1Z5WmItdFN6UFdHRnpzZExYT0NBelBrcTRlLW9BTnNBcXlCaWt2N3ZtMjdRdDRiNDZYLXR0Q0tmdXZjdHRSV9IBngFBVV95cUxOWmRPVTdfZnd3MmRIYmVDR0ZxazJndzBTRlE4Yi1oTkVPcHJCdkZYdUR0R3dlUlZMN0Q1aXN2WTFpekxOVF9nY0J6OWRsUmhIWExJVGMwYzRuUWFxRE80b3VrY3RrVHVNaFk1ZzluWTlWM1hseTBIelFLd2gzR1BBd2dyNjBsTEcxbm1LLWdUMGxRcW5JSnNPeVpEdlBTdw?oc=5) |
| The Hacker News | Forg365 PhaaS Targets Microsoft 365 with Device Code and AitM Session Theft | [Source Link](https://news.google.com/rss/articles/CBMif0FVX3lxTFAzb0RQdFZSYmtRRlRaYmU2YWdFNElCQ3FubE1lQ3V2N2JCVXBfcFFJTG9zcnR6V1RnVmNSNU1FaXhDakNHLUp2UGpER1ZoNTQ1OWFiZkEzWFJvQzNUdTc3R0lKRUxyaExnZlBETUpyQWpuclFoX0tUMkFJb250cVk?oc=5) |
| BleepingComputer | New phishing kits target Microsoft 365 accounts, evade MFA | [Source Link](https://news.google.com/rss/articles/CBMiqAFBVV95cUxQbjRKc29ZQ3dVUTljVmVqUVZ6UFlxTmlTSFhseVlsNFBWdFlZelpEWm9mTU1HeGRwMHpqME5STHRzV1ZUN2I1TFYyUkxEMXFzQ3pUTzRvRV9NX0x1U0JPZmFXSW5UQXlZMVFGYjN3Z2FTUnZheUwweVZteThLOW1PTkVqLXdrQlhnemZ4R3VYUEV0eWc1R2trUWpqaU9yaXM1VW1pbjBzM1PSAa4BQVVfeXFMTXBmaXU1ZDRwelNwaEl1QXE5aVFDa2d3bmZUdzk5OWpOSDRoaDF2TmVGM2tCQ0pvbXUtR3pURUVnY0wyWWdxQVU1WnVFMGh0YWJ0a3owQTNuOFBkQS1vOU9xQy1FRTFydzhMQndPdXFEdVNkamw4T2pqWUpkcXZCUGVWWV9NZlN6TXdFS3JKNHRiNkZ1U0FFZHlxWHlOblhuekZXRkxLajdmLXZ) |

---
*Canonical Source: https://pulse.byoviral.com/trend/2026-07-15/new-phishing-kits-target-microsoft-365-accounts-evade-mfa*