Forg365

Forg365 is a phishing-as-a-service operation focused on compromising Microsoft 365 accounts. It uses both adversary-in-the-middle phishing and device-code phishing to obtain access to victim accounts, capture session material, and abuse legitimate OAuth authentication flows. The operation incorporates AI-assisted lure generation into its operator workflow, indicating a service model designed to streamline phishing campaign creation and scaling. The platform provides operators with a management dashboard for creating campaigns, managing phishing links, configuring OAuth applications and SMTP profiles, and handling stolen authentication material. Reported post-compromise functionality includes token management, mailbox keyword monitoring, and account intelligence features that help operators identify valuable messages and maintain access to compromised tenants. A notable component associated with Forg365 is ForgCookie, a browser extension for Chromium-based browsers that refreshes Microsoft single sign-on cookies through a silent OAuth process. This capability is intended to preserve persistent access to compromised Microsoft services without requiring repeated victim interaction. Forg365 also demonstrates mature defense-evasion and anti-analysis measures. Reported protections include bot detection, debugger traps, sandbox checks, encrypted redirectors, polymorphic code, and conditional redirection of suspected researchers to benign content. Operationally, the service has been observed using common phishing infrastructure and legitimate cloud-based delivery services to support email distribution, landing pages, and campaign management. Forg365 appears closely aligned with credential and session theft against enterprise cloud identities, particularly Microsoft 365 users. Similarities have been noted with other Microsoft-focused phishing kits such as Kali365 and Sneaky2FA, although no confirmed attribution link has been established.