Run OAuth 2.0 device-code and illicit-consent phishing attacks against Microsoft Entra ID, using TokenTactics-style tooling to steal access and refresh tokens, bypass MFA, and pivot across Microsoft 365 services. Use for authorized red-team engagements simulating device-code or consent-grant phishing against a tenant you have explicit written permission to test.
Install
KitScout test notes
Not tested by KitScout yet. When our harness runs it, pros, cons and the tasks we tried appear here, with the date and evidence.
Similar tools
card-twitter107,474 ★ Twitter quote or data card designed to pair with a post.
card-xiaohongshu107,474 ★ Xiaohongshu-style knowledge cards, arranged as a swipeable multi-card carousel.
Facebook Automation79,395 ★ Automate Facebook Page management including post creation, scheduling, video uploads, Messenger conversations,
social60,077 ★ When the user wants organic social content for LinkedIn, X, Instagram, TikTok, or Facebook, or asks what to po
hermes-tweet42,470 ★ Install and operate Hermes Tweet, a Hermes Agent plugin for X/Twitter research, timeline reading, tweet analys