A new phishing-as-a-service (PhaaS) platform named Forg365 has emerged, specializing in the theft of Microsoft 365 accounts. The platform integrates adversary-in-the-middle (AiTM) and device code phishing techniques with AI-assisted lure generation, and provides a browser extension for persistent access to compromised accounts.
Researchers at ZeroBEC email security company initiated an investigation after observing phishing emails designed to mimic business documents from trusted services. These emails utilized Amazon SES for delivery, while their bodies incorporated images and tracking resources hosted by SendGrid, suggesting a sophisticated operation capable of blending malicious messages with legitimate email traffic.
The Forg365 platform offers a comprehensive suite of tools for attackers, including device-code phishing, AiTM phishing, AI-assisted email content generation, and token and cookie management for post-compromise operations. Researchers gained access to the Forg365 dashboard, which allows operators to create and manage phishing campaigns, configure OAuth applications and SMTP profiles, manage tokens, and generate phishing emails using integrated AI.
While AI-driven phishing lure creation is not new, Forg365's direct integration of this feature within its control panel is notable. This allows operators to craft, refine, and deploy malicious emails from the same interface used for managing post-compromise activities. According to ZeroBEC, this integration strategically lowers the cost and effort associated with developing custom phishing content and building custom PhaaS platforms.
The dashboard also includes an account intelligence feature and a keyword monitoring tool that scans compromised mailboxes for specific terms, alerting operators to matches. For persistent access, Forg365 provides a browser extension called ForgCookie, compatible with Google Chrome, Microsoft Edge, and Brave. This extension automatically refreshes Microsoft SSO cookies by requesting account data from the Forg365 backend, clearing existing session cookies, and initiating a silent OAuth flow to capture new ones, thereby maintaining attacker access to Microsoft services linked to the victim's account.
Forg365 supports two primary attack vectors. The first is device-code phishing, where victims are presented with a Microsoft-style verification page and instructed to complete authentication using Microsoft's legitimate OAuth 2.0 device code flow. This method is typically designed for devices with input limitations, such as smart TVs or IoT appliances. Instead of directly targeting passwords, victims are tricked into authorizing an attacker-controlled device. The second method is AiTM phishing, which involves the platform acting as a proxy for authentication requests and data exchanged between Microsoft infrastructure and the target account, capturing session cookies in the process.
To evade detection and prevent researchers from accessing its administration panel, Forg365 incorporates an AntiBot feature. This feature includes AES-encrypted redirectors, bot detection, debugger traps, sandbox checks, and polymorphic code. Additionally, if a VPN connection is detected, the platform redirects to innocuous content rather than exposing its phishing pages.
ZeroBEC reports that Forg365 leverages Amazon SES for email delivery and Cloudflare Pages for hosting its landing pages. The Gophish infrastructure is also utilized for campaign delivery. To mitigate risks, users are advised to restrict or disable Microsoft device-code authentication unless absolutely necessary and to monitor Microsoft Entra logs for device-code authentication events. Furthermore, organizations should regularly investigate mailbox rules, new device sign-ins, Microsoft Authentication Broker activity, and OAuth grants for any unexpected entries. In cases of suspected compromise, all tokens and sessions should be revoked and refreshed promptly.
