{"id":1729,"date":"2026-07-13T13:39:29","date_gmt":"2026-07-13T13:39:29","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=1729"},"modified":"2026-07-13T13:39:29","modified_gmt":"2026-07-13T13:39:29","slug":"forg365-phaas-targets-microsoft-365-with-device-code-and-aitm-session-theft","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=1729","title":{"rendered":"Forg365 PhaaS Targets Microsoft 365 with Device Code and AitM Session Theft"},"content":{"rendered":"
\n
<\/a><\/div>\n

A new phishing-as-a-service (PhaaS) operation called Forg365<\/strong> is using a combination of device code phishing, adversary-in-the-middle (AitM) tactics, antibot evasion, artificial intelligence (AI)-assisted lure creation, and post-compromise mailbox operations targeting Microsoft 365 accounts.<\/p>\n

Distributed via Telegram and costing $400 a month (or $3,800 per year), attack chains leverage phishing lures that make use of legitimate email delivery infrastructure, such as Amazon Simple Email Service (Amazon SES) and Twilio SendGrid, to imitate a redirection chain that blends into regular email traffic before it ends in Forg365-controlled domains.<\/p>\n

\u00abThe panel exposes a mature operator workflow: accounts, links, invitations, OAuth app configuration, redirect links, SVG generation, campaign sending, SMTP profiles, SMTP rotation, AI email generation, token vaulting, account intelligence, keyword alerts, viewer links, and browser-extension support,\u00bb ZeroBAC said<\/a>.<\/p>\n

The email security company said the PhaaS kit is best understood as similar to the Kali365 (aka Octopi365 and Freedom365) and Sneaky 2FA ecosystem, reflecting the industrialization of the business model, which is now combining bringing together lure creation, delivery, evasion, token\/session handling, and post-compromise operations under a subscription-based setup that allows even threat actors with little-to-no technical expertise to orchestrate phishing campaigns with minimal effort and at scale.<\/p>\n

Attack chains using Forg365 have been observed using business document-themed or remittance approval lures to trick recipients into clicking on malicious links. The sender domain uses Amazon SES for delivery, while the message body contains SendGrid-hosted images or tracking resources.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Customers who successfully complete Telegram registration utilize an operator panel accessible over the clearnet (\u00ablogfriend[.]com\/login\u00bb), from where they can generate lures, set up campaigns, and manage captured tokens.<\/p>\n

<\/p>\n

\u00abForg365 includes a device-auth phishing branch that presents a Microsoft-styled verification code page and pushes the victim into a legitimate Microsoft Authentication Broker sign-in flow,\u00bb ZeroBAC explained. \u00abThe victim sees real Microsoft authentication surfaces, but the code authorizes an attacker-controlled session.\u00bb<\/p>\n

For AitM phishing, the platform employs route tokens, session cookies, and traffic classification to determine whether to serve phishing content or a benign decoy. If a VPN connection is detected, the kit redirects to innocuous decoy content instead of exposing the phishing pages.<\/p>\n

\"\"<\/a><\/div>\n

A notable aspect of the Forg365 platform is that it offers an extension named ForgCookie for Chromium-based browsers like Google Chrome, Microsoft Edge, and Brave that is designed for continued access to the compromised accounts. Described as an \u00abautomatic SSO cookie refresh for Microsoft services,\u00bb the add-on acts as an intermediary between the token acquisition and browser access by cycling through the steps listed below –<\/p>\n