Start from the recaptured record, not the alert. Reset the exposed credential, then check the same record for the artifacts that came with it. If a session cookie or refresh token was captured in the same event, revoke it in the identity provider before the reset is marked complete. If the kit captures MFA codes, revoke and re-issue MFA, then add the identity to phishing target list monitoring. Close the loop by confirming the identity has no other recaptured exposures across personal accounts, since reuse is what turns one phish into several.

Yes. SpyCloud matches recaptured phishing exposures against your directory and triggers the response without an analyst in the loop: a password reset, a session and refresh token revocation, or a step-up authentication requirement through Okta, Entra ID, Active Directory, Ping Identity, or a SOAR playbook. Analysts keep the exceptions and investigations, and the routine reset and revoke work runs on the match.”

Phishing captures one session at the moment it’s issued, for the service the kit was built to proxy. Infostealer malware captures everything the browser holds, across every site, plus host detail that tells you the device itself was compromised. Phishing exposure is scoped to an application and an identity. Malware exposure requires the device to be treated as compromised alongside the identity.

Because the operator often isn’t holding the password. AiTM and device code kits capture the session cookie and refresh token issued at sign-in, and a reset doesn’t reliably revoke them. In Microsoft Entra ID, a password change revokes tokens from password-based sign-in, but tokens from passwordless sign-in, tokens issued to confidential clients, and sessions at downstream apps stay valid. Until your team explicitly revokes the session and refresh token at the identity provider, the account is still open, and the ticket that says remediated describes the wrong artifact.

Recaptured phishing data is ingested, parsed, and matched to your identities as it’s acquired from the criminal underground, then delivered through the API, integrations, or the console. Timing depends on how the operation distributes what it collects, which is why kit coverage matters more than any single feed.

A kit sits between the victim and the real login page, relaying every step of the legitimate sign-in, including the MFA challenge, while capturing the session cookie and token issued at the end of it. The victim authenticates to the real service through the proxy and sees a normal sign-in, while the kit keeps what the service issues in response. That’s what separates AiTM from older, static phishing pages: the login itself succeeds, so nothing about the sign-in looks wrong to the victim or to most detection tools.

Device code phishing abuses the OAuth 2.0 Device Authorization Grant, a flow built for signing into devices that lack a keyboard. The victim is tricked into entering an attacker-generated code on the real Microsoft 365 login page, and the authentication happens exactly as designed, on the victim’s own device, satisfying any passkey or FIDO2 check already in place. What changes is where the resulting token goes: it’s issued to whichever device requested the code, which in this attack is the attacker’s, not the victim’s. The passkey check happens exactly where it’s supposed to. It was simply never asked to protect the device that ends up receiving the token.

Phishing kits capture session cookies, authentication tokens, MFA codes, and credentials. AiTM kits like Tycoon 2FA proxy a real login and keep the session cookie issued at the end of it. Device code kits like Kali365 collect the refresh token Microsoft issues to the attacker’s device. SMS phishing panels like YYlaiyu prompt victims for one-time passcodes and card numbers in real time.

SpyCloud recaptures phished credentials, session cookies, refresh tokens, and phishing targeting data directly from criminal infrastructure and active phishing campaigns. SpyCloud matches each record to the affected identity, so your team can reset, revoke, and step up authentication through your identity provider.