Forg365

The victim sees real Microsoft authentication surfaces, but the code authorizes an attacker-controlled session.

Forg365 includes a device-auth phishing branch that presents a Microsoft-styled verification code page and pushes the victim into a legitimate Microsoft Authentication Broker sign-in flow. The victim sees real Microsoft authentication surfaces, but the code authorizes an attacker-controlled session. | A new phishing-as-a-service (PhaaS) operation called Forg365 is using a combination of device code phishing, adversary-in-the-middle (AitM) tactics, antibot evasion, artificial intelligence (AI)-assisted lure creation, and post-compromise mailbox operations targeting Microsoft 365 accounts.

Attack chains using Forg365 have been observed using business document-themed or remittance approval lures to trick recipients into clicking on malicious links.

The victim sees real Microsoft authentication surfaces, but the code authorizes an attacker-controlled session.

The victim sees real Microsoft authentication surfaces, but the code authorizes an attacker-controlled session.

The panel also offers SMTP rotation, campaign scheduling, redirect links, encrypted SVG files, and templates impersonating services such as SharePoint, OneDrive, DocuSign, and Adobe Acrobat Sign.

The victim sees real Microsoft authentication surfaces, but the code authorizes an attacker-controlled session.

If a VPN connection is detected, the kit redirects to innocuous decoy content instead of exposing the phishing pages.

Forg365 also uses anti-bot and cloaking features to avoid security scanners. For example, researchers observed it redirecting traffic from VPN networks to harmless decoy websites instead of displaying phishing content.

A notable aspect of the Forg365 platform is that it offers an extension named ForgCookie for Chromium-based browsers... designed for continued access to the compromised accounts... Captures resulting Microsoft cookies across Microsoft domains.

For AitM phishing, the platform employs route tokens, session cookies, and traffic classification to determine whether to serve phishing content or a benign decoy.

Its Token Vault feature can store captured authentication tokens.

If a VPN connection is detected, the kit redirects to innocuous decoy content instead of exposing the phishing pages.

Forg365's extends beyond simple credential and token harvesting to facilitate a wide array of post-compromise actions, including monitoring for specific keywords in compromised email accounts and drafting a message response to a particular email thread using assistance from AI.

To counter these threats, it's recommended to... audit mail-flow rules... The campaign succeeded in reaching the inbox because the recipient organization still maintained an active forwarding relationship from a pre-acquisition namespace into a current mailbox.

A browser extension called ForgCookie reportedly automatically refreshes Microsoft single sign-on cookies, helping criminals retain browser-based access after the victim has authenticated.

For AitM phishing, the platform employs route tokens, session cookies, and traffic classification to determine whether to serve phishing content or a benign decoy.