# Forg365: The Next Generation of Phishing-as-a-Service Targets Microsoft 365 with AI-Crafted Lures


A sophisticated phishing-as-a-service (PhaaS) platform called Forg365 is actively targeting Microsoft 365 users by combining multiple attack methodologies—adversary-in-the-middle (AiTM) proxying, device-code authentication exploits, and AI-assisted social engineering—all integrated into a unified attack dashboard. Security researchers at ZeroBEC discovered the operation while analyzing targeted phishing campaigns and gained access to the platform's administration panel, revealing a mature, well-engineered attack infrastructure capable of stealing credentials, maintaining persistent access, and exfiltrating data from compromised mailboxes.


## The Threat: A New Standard in Commercial Phishing Operations


Forg365 represents a notable escalation in the sophistication of phishing-as-a-service offerings. Unlike earlier PhaaS platforms that required technical knowledge to operate, Forg365 abstracts the complexity of credential theft and post-compromise operations into a user-friendly dashboard, complete with built-in AI capabilities for generating convincing lures. The platform is specifically engineered to target Microsoft 365 users—a logical choice given the widespread adoption of Microsoft's cloud services across enterprises globally.


The platform's creators have drawn architectural lessons from earlier infamous PhaaS operations such as Kali365 and Sneaky2FA, incorporating proven attack vectors while adding new capabilities. While ZeroBEC researchers could not establish direct operational links between these platforms, the feature overlap suggests a deliberate evolution within the underground cybercrime ecosystem. Forg365 operators deliver phishing emails through legitimate services—Amazon SES for email delivery and SendGrid for hosting images and tracking pixels—a tactic that allows malicious messages to blend seamlessly into normal business email traffic and evade traditional gateway filters.


## How It Works: Multiple Attack Paths, Single Dashboard


Forg365 supports two primary attack methodologies, each targeting different organizational security postures and user behaviors:


### Device-Code Phishing


The first attack vector exploits Microsoft's device-code authentication flow, a legitimate OAuth 2.0 mechanism designed for endpoints with input constraints such as smart TVs, IoT appliances, and other devices without full browsers. Victims are redirected to pages mimicking Microsoft's interface and shown a verification code alongside instructions to complete authentication using another device—typically their smartphone or desktop computer.


Rather than requesting credentials directly, the phishing interface tricks users into authorizing an attacker-controlled device through the actual OAuth 2.0 device code flow. This approach:

  • Bypasses password requirements, making it effective against organizations enforcing strong password policies
  • Evades traditional MFA protections by completing authentication through legitimate Microsoft infrastructure
  • Appears legitimate to users because they are interacting with real Microsoft systems, just with an attacker-generated authorization code

    • ### Adversary-in-the-Middle (AiTM) Phishing


    The second approach uses a proxy positioned between the victim's browser and Microsoft's authentication infrastructure. As users submit credentials or complete multi-factor authentication challenges, the proxy transparently captures session cookies and authentication tokens. This method proves effective against users who:

  • Have already trained themselves to look for "legitimate" login pages
  • Use password managers (which often auto-fill credentials on convincing phishing pages)
  • Complete MFA challenges, providing attackers with valid authentication tokens

    • ## Platform Capabilities: The Attack Infrastructure


    What distinguishes Forg365 from simpler phishing kits is the comprehensiveness of its control infrastructure. Researchers who accessed the administration panel documented the following features:


    | Feature | Function | Impact |

    |---------|----------|--------|

    | Campaign Management | Create and configure phishing campaigns | Enables large-scale targeting |

    | Link Management | Generate, monitor, and rotate phishing URLs | Maintains campaign persistence despite takedowns |

    | OAuth App Configuration | Register fake Microsoft applications | Enables credential harvesting and account compromise |

    | AI Email Generation | Automatically create custom phishing content | Reduces operational overhead and improves social engineering effectiveness |

    | Token & Cookie Management | Store and organize stolen credentials | Facilitates post-compromise operations |

    | Account Intelligence Dashboard | Analyze compromised mailbox contents | Enables targeted exfiltration and follow-up attacks |

    | Keyword Monitoring | Alert operators when predefined terms appear in victim mailboxes | Detects and prioritizes sensitive communications (financial transactions, executive correspondence, etc.) |


    ### The ForgCookie Persistence Mechanism


    Perhaps most concerning is the ForgCookie browser extension, compatible with Chrome, Edge, and Brave. Once installed on a victim's system, the extension provides persistent access to compromised Microsoft services without requiring stored passwords. The extension operates by:


    1. Requesting account data from the Forg365 backend to identify the victim's account

    2. Clearing existing session cookies to force re-authentication

    3. Triggering a silent OAuth flow to capture fresh Microsoft SSO cookies

    4. Maintaining updated credentials automatically as sessions expire


    This persistence mechanism transforms a one-time credential theft into long-term account compromise, giving attackers sustained access to email, OneDrive, Teams, SharePoint, and other Microsoft 365 services.


    ## Technical Defense Evasion


    Forg365 incorporates multiple anti-analysis features designed to repel security researchers and automated detection systems:


  • AES-encrypted redirectors to obscure attack infrastructure
  • Bot detection and anti-debugging mechanisms to identify and block automated security tools
  • Sandbox evasion techniques to evade detection by security appliances
  • Polymorphic code that changes its structure to defeat signature-based detection
  • VPN detection that denies access to known security researchers and VPN providers

    • These features indicate a sophisticated threat actor with knowledge of security research practices and forensic analysis techniques.


    ## HackWire Analysis: The Democratization of Advanced Phishing


    The integration of AI-assisted email content generation directly into Forg365's control panel marks a watershed moment in phishing evolution. While AI-generated phishing content is not novel, the strategic placement of this capability within the administrative interface represents something more significant: the industrialization of phishing-as-a-service.


    Historically, successful phishing campaigns required skilled operators capable of researching targets, crafting contextually appropriate lures, and managing complex attack infrastructure. This created a natural barrier to entry. Forg365 systematically eliminates these barriers. An operator with minimal technical skill can now:


  • Input target job titles, industries, or company names into an AI model
  • Generate dozens of contextually appropriate phishing emails in minutes
  • Configure OAuth traps and device-code flows without understanding the underlying protocol mechanics
  • Monitor compromised mailboxes for keywords and automatically flag high-value targets
  • Maintain persistent access through an automated cookie refresh mechanism

    • The result is a dramatic reduction in the operational overhead required to conduct sophisticated, targeted attacks at scale. This efficiency directly translates to lower costs, which—as ZeroBEC researchers note—reduces the barrier to entry for building and operating PhaaS platforms themselves. We are witnessing the emergence of a commodified attack infrastructure accessible to mid-tier threat actors with modest technical skill.


    The Microsoft 365 ecosystem bears particular risk. Microsoft's OAuth architecture, while well-designed from a security perspective, creates a large surface area for PhaaS operators. Device-code flows, originally designed for legitimate scenarios, become an authentication shortcut in the hands of attackers. Cookie management, a necessary feature for seamless user experience, becomes a persistence vector when attackers control the refresh process.


    Organizations should expect device-code phishing to become increasingly common as attackers discover its effectiveness. Unlike password reuse or MFA fatigue, device-code attacks exploit legitimate authentication mechanisms, making them harder to detect and defend against using conventional security controls.


    — HackWire Editorial


    ## Security Implications and Recommendations


    ### For Organizations


    Immediate Actions:

  • Review OAuth app permissions in your Microsoft 365 environment for unfamiliar or suspicious applications
  • Enable conditional access policies that restrict sign-ins from untrusted device types and unusual geographic locations
  • Monitor for unauthorized device-code authentications by reviewing Azure AD sign-in logs for "Device Code Flow" entries from unexpected sources
  • Inventory browser extensions used across your organization and restrict installation policies to approved applications only

    • Long-Term Defenses:

  • Implement passwordless authentication methods (Windows Hello, FIDO2 security keys) to eliminate password-based phishing vectors entirely
  • Deploy advanced email filtering that analyzes sender reputation, OAuth application registration patterns, and behavioral anomalies
  • Enable sign-in risk policies that challenge authentications exhibiting unusual characteristics and require additional verification
  • Conduct security awareness training specifically addressing device-code phishing and OAuth authorization screens

    • ### For Microsoft 365 Administrators


  • Review and audit all OAuth consented applications in your tenant
  • Implement token lifetime policies that force periodic re-authentication
  • Enable detailed logging and monitoring of device-code flow authentications
  • Consider restricting device-code flows to specific applications or requiring additional verification steps

    • ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)