# New phishing kits target Microsoft 365 accounts, evade MFA

> **Newsylist Open Intelligence Dossier** · First detected: 2026-07-15 10:29 UTC · Category: Technology · Sources: 9 · Current Velocity: 9.75

## Executive Summary
9 news sources are covering this Technology story right now — Newsylist is tracking how fast it spreads.

## Intelligence Brief
"New phishing kits target Microsoft 365 accounts, evade MFA" is generating significant coverage in the Technology category, with 13 articles from 9 distinct sources tracked by Newsylist so far.


Outlets currently covering the story include cyberpress.org, Cyber Daily, gbhackers.com and The Hacker News. Newsylist measures a story's velocity from how quickly new articles appear and how many independent newsrooms join the coverage.


Synthesized from multi-source international reporting and live coverage telemetry under Newsylist open intelligence methodology.

## Verified Facts & Key Claims
### Why is "New phishing kits target Microsoft 365 accounts, evade MFA" trending?
Because 9 independent news sources published 13 articles about it in a short window — a coverage burst Newsylist classifies as a trend.

### How does Newsylist measure this trend?
Newsylist scores velocity from the rate of new articles weighted by source diversity, snapshotted hourly. The full method is public on our methodology page.

### Is this trend still active?
The status badge on this page updates hourly: rising, peaking, cooling, or archived once coverage stops for 48 hours.

## Key People, Organizations & Locations
Microsoft, FBI, Hackers, Customers, Access, Misconfigured Server Reveals Three Evilginx Phishing Operations Targeting Microsoft, Users With SharePoint Links and Cloudflare Anti-Bot Checks, Kratos PhaaS Targets Microsoft, Exfiltrate Credentials, Kratos Uses Cloudflare Turnstile Obfuscated Login Pages and PHP Endpoints

## Multi-Source Evidence Table
| Source Outlet | Headline | Published (UTC) | Verification URL |
|---|---|---|---|
| cyberpress.org | Kratos Uses Cloudflare Turnstile, Obfuscated Login Pages, and PHP Endpoints to Exfiltrate Credentials | 2026-07-14 12:49 | [Source Link](https://news.google.com/rss/articles/CBMib0FVX3lxTE03bDUxSlFjZ2lZSVdhSGYzaHFkVXRBQ2RhNXRPZEM5STYtdmdGcUxSZ0tNeGoteGo3VFR6TDhURGpWSW9tQkstTEZIWkxJamZwZHMyRThlQ3FDb3ViNTlwRi0zaEJZMm5aSlRvdzk5Yw?oc=5) |
| Cyber Daily | Hackers targeting Microsoft 365 in widespread vishing campaign, Okta warns | 2026-07-14 12:49 | [Source Link](https://news.google.com/rss/articles/CBMitAFBVV95cUxOYURHQ1k0Q195OWpQYmdYWk9RbUg5Smt1NXpueHFlSENNcldya2xQZ1Nra3JmTTdpY1FXREptbzU0RTJqYTRDN1RQS1dFSE53bXc5V0doWmVCaV9IYTdhRl8tdTF3YVZ5WmxaNzFZU3hROFh4b1hqam5tTzZfYW1pMEJ4UUh4TTIwc1o3MmNBTGFmRmtBUFU3U0lsTUVCNTV4MERIMFd4NVVaa0JTdzVhS29hWXE?oc=5) |
| gbhackers.com | Kratos PhaaS Targets Microsoft 365 Users With SharePoint Links and Cloudflare Anti-Bot Checks | 2026-07-14 12:49 | [Source Link](https://news.google.com/rss/articles/CBMiaEFVX3lxTE9vUm01LS0tTkpJMWVpX2lwSnJzYWtCLVZ0eENRTUJ3S2FDay1JSm5xeGZUU2xBZ3h3YVFrbm5lVUVnNXN1TGJIN1ZheGNfUVpxT1ktQnFWQlZ6UkVCMnZ0eGdEenBkZk9O0gFuQVVfeXFMTW4yeTVGajFqWG5oamdoYjRnS1dYeHZtelI4M0lkMlVSQkFZWVRVVHR5N3FRNW03Uk5RVl91elhoREc3NnRtNzlvdkpWNmlFX3dpZW5VNWhGa0hNcHZiekdtUXNNeHdvclIwVnEzaVE?oc=5) |
| The Hacker News | Misconfigured Server Reveals Three Evilginx Phishing Operations Targeting Microsoft 365 | 2026-07-14 12:49 | [Source Link](https://news.google.com/rss/articles/CBMifkFVX3lxTE9YUk5lYkNBU1lxc2lDTXVpNFNPOHd5Q0p5WVZDQmxPWUlHYklSWlU1VGxubE9kR0xTN3QtZHQtdUtzekxWMUl6c19IdHdkWWUzbE14S1BUdjNkdU5BOE9jUW9OMzVpVGdOdGdVRHRqZXlBNVlnOUo5ZVpOcGJ2QQ?oc=5) |
| The National CIO Review | Attackers Find a New Way Into Microsoft 365 | 2026-07-14 12:49 | [Source Link](https://news.google.com/rss/articles/CBMipwFBVV95cUxNT3Y4VFFPY2tQVDJRelF2dW5BT1ZmclhLeEFwSDI4dExmbHMyQ1lYNnhSTmNUc0FTNTcwOWQ0T085YVFWWlZENDhNejFtMzIxNjVZYjI4Z3Npazl2dXNBUG9xV3hQbDJSUS1iRkk0WU5zbnl5OXBwX3NxVFdNRkE2UzRrWHZYWE5ObmQ4c1hnUGw2NGd5NmYyaWZfSlJjdDYteUpUZGtIYw?oc=5) |
| BleepingComputer | New phishing kits target Microsoft 365 accounts, evade MFA | 2026-07-14 12:49 | [Source Link](https://news.google.com/rss/articles/CBMiqAFBVV95cUxQbjRKc29ZQ3dVUTljVmVqUVZ6UFlxTmlTSFhseVlsNFBWdFlZelpEWm9mTU1HeGRwMHpqME5STHRzV1ZUN2I1TFYyUkxEMXFzQ3pUTzRvRV9NX0x1U0JPZmFXSW5UQXlZMVFGYjN3Z2FTUnZheUwweVZteThLOW1PTkVqLXdrQlhnemZ4R3VYUEV0eWc1R2trUWpqaU9yaXM1VW1pbjBzM1M?oc=5) |
| The Hacker News | Hackers Use Fake Microsoft Entra Passkey Enrollment to Gain Microsoft 365 Access | 2026-07-14 12:49 | [Source Link](https://news.google.com/rss/articles/CBMie0FVX3lxTE8zdUFjeHVjWGUzenVGeW4xbi1LMENqd0FNaUl1amhsdEJRS3Zhc0hGSWZ4RjBwMmFITWozdU0wMV9oRzBNQVk4c2tldWlpb3ZRdGQ4V09ZWVB5cXR3Wm44X2xlTHZYOFFmY0JZMGdSZC14S3A3YWVsenpUVQ?oc=5) |
| News4JAX | FBI warns Kali365 phishing platform is targeting Microsoft 365 users; Floridians report $12 million in losses | 2026-07-14 12:49 | [Source Link](https://news.google.com/rss/articles/CBMi6wFBVV95cUxPNnNBd3dPc1dBc0hNWkFLdVh2Tk1RUG1xM21YcnZyd29BQnBhekd6ZzZSYzhFLVRYbFB4QjFKNHhaS3MwMVhFRGs3bXZPZkxEU21MbWJBWEZPVndFTFFwM2theTVjOFRYVEtobDJqVHBJdEY4R2NGb3JSemFzMnB5bWl6QnRmM2o5cUM4RzN6RFh2dWdOZTZyNWotRnQ4d0hOOHNWMkZLRTZWV0JKRXVCcmlxbUdsUElRM0lYOEF3TzgxaFZNY1Q1SDZkV3VjLXZCOE5KZEs1eDUtVlVTcW5HODMyV2wxbC16VXlR?oc=5) |
| csoonline.com | Phishing for dummies: Forg365 lowers barrier to M365 account takeovers | 2026-07-14 12:49 | [Source Link](https://news.google.com/rss/articles/CBMitwFBVV95cUxNYzFuT0ltbnVHc2Rkam9qc1lBTjBoQmdxVXB2azhrUEkyM3YtVVRwM1F6a2ZjNTZFSXZiMkVXUjlVT3lEUjVQYm9GanRzRWlRS1I1YlBLOTNQRExnQXJfUlQ3Ym4xUlBSRUVlcS04SnRYY1JUMkpZRzlnWlMzY1JrQUxfZG5ySWU1M1ZPNEVpcS05RlpZODVSdVZzMTRLWG9RUXQxSVNFQ2hsZHhLQXozay1uQm5aT1U?oc=5) |
| gbhackers.com | Hackers Abuse OAuth Device Codes and Entra ID Enrollment for Persistent SaaS Access | 2026-07-14 12:49 | [Source Link](https://news.google.com/rss/articles/CBMibkFVX3lxTE5jS1RjMC1kYUlDOVJVeDI1T29MaWFINU9DOUt2MDVBMXp6WDQ2MElBeGFLRkExMVlQckwyVmxHUnFtYl9Fd3ZVQjBkZVg5UmtwNWp0dkVQWThhVjRmSmZzc0FzNzlWVmEwRnFkMU9B0gFzQVVfeXFMUERaRVZhVmVIbjFLeVMwby1mczI1amVVMENHTzZCWWpfZkppVnEzNDFzOGFvQ2lad3pIT0s4V250bDlYSU02WjUzQnZOTldNdWt6cDBYaVZwd2dUUXctdTVtdE1rM25La3R5dkk0R0g0S0dmTQ?oc=5) |
| SecurityWeek | Okta Warns of Vishing Attacks Targeting Microsoft 365 Customers | 2026-07-14 12:49 | [Source Link](https://news.google.com/rss/articles/CBMimAFBVV95cUxOOXZsNzN6ajhTbVQwdGtTcTExbHU1Rlhma2MwQkZYeFRUQ3lPWU1rWGFzazdIUTJjLTBUazVTUzJzY1Q2aU85TVkwNDYyVHJJUk8yaExfdXFlZ1Z5WmItdFN6UFdHRnpzZExYT0NBelBrcTRlLW9BTnNBcXlCaWt2N3ZtMjdRdDRiNDZYLXR0Q0tmdXZjdHRSV9IBngFBVV95cUxOWmRPVTdfZnd3MmRIYmVDR0ZxazJndzBTRlE4Yi1oTkVPcHJCdkZYdUR0R3dlUlZMN0Q1aXN2WTFpekxOVF9nY0J6OWRsUmhIWExJVGMwYzRuUWFxRE80b3VrY3RrVHVNaFk1ZzluWTlWM1hseTBIelFLd2gzR1BBd2dyNjBsTEcxbm1LLWdUMGxRcW5JSnNPeVpEdlBTdw?oc=5) |
| The Hacker News | Forg365 PhaaS Targets Microsoft 365 with Device Code and AitM Session Theft | 2026-07-14 12:49 | [Source Link](https://news.google.com/rss/articles/CBMif0FVX3lxTFAzb0RQdFZSYmtRRlRaYmU2YWdFNElCQ3FubE1lQ3V2N2JCVXBfcFFJTG9zcnR6V1RnVmNSNU1FaXhDakNHLUp2UGpER1ZoNTQ1OWFiZkEzWFJvQzNUdTc3R0lKRUxyaExnZlBETUpyQWpuclFoX0tUMkFJb250cVk?oc=5) |
| BleepingComputer | New phishing kits target Microsoft 365 accounts, evade MFA | 2026-07-14 12:49 | [Source Link](https://news.google.com/rss/articles/CBMiqAFBVV95cUxQbjRKc29ZQ3dVUTljVmVqUVZ6UFlxTmlTSFhseVlsNFBWdFlZelpEWm9mTU1HeGRwMHpqME5STHRzV1ZUN2I1TFYyUkxEMXFzQ3pUTzRvRV9NX0x1U0JPZmFXSW5UQXlZMVFGYjN3Z2FTUnZheUwweVZteThLOW1PTkVqLXdrQlhnemZ4R3VYUEV0eWc1R2trUWpqaU9yaXM1VW1pbjBzM1PSAa4BQVVfeXFMTXBmaXU1ZDRwelNwaEl1QXE5aVFDa2d3bmZUdzk5OWpOSDRoaDF2TmVGM2tCQ0pvbXUtR3pURUVnY0wyWWdxQVU1WnVFMGh0YWJ0a3owQTNuOFBkQS1vOU9xQy1FRTFydzhMQndPdXFEdVNkamw4T2pqWUpkcXZCUGVWWV9NZlN6TXdFS3JKNHRiNkZ1U0FFZHlxWHlOblhuekZXRkxLajdmLXZ) |

---
*Canonical Source: https://www.newsylist.com/trend/2026-07-15/new-phishing-kits-target-microsoft-365-accounts-evade-mfa*
*Synthesized by Newsylist Open Intelligence Engine under E-E-A-T journalistic standards.*