Inside Wazza: A Newly Observed Device Code Phishing Kit Targeting Microsoft 365 Accounts

Reported 20 Oct 2026 by otx · Severity: medium

A newly observed multi-stage phishing kit named Wazza has been actively targeting Microsoft 365 accounts since early July 2026. The campaign delivers phishing emails from compromised accounts containing PDF lures with business themes like invoices and contracts. These PDFs redire