A New Breed of Phishing-as-a-Service
A fresh threat has emerged on Telegram, and it’s laser-focused on one target: Microsoft 365. Dubbed Forg365, this phishing-as-a-service (PhaaS) operation bundles several nasty tricks into one affordable subscription. For just $400 a month — or $3,800 if you pay annually — cybercriminals get a toolkit that can steal credentials, bypass multi-factor authentication, and even take over active sessions.
Forg365 isn’t your run-of-the-mill phishing kit. It combines device code phishing, adversary-in-the-middle (AitM) proxies, AI-generated lure pages, and antibot evasion. The goal? Empty out a victim’s Microsoft 365 account without raising alarms. And at that price point, it’s accessible to a wide range of attackers.
How Forg365 Works: Device Code Phishing + AitM
The core of Forg365’s attack chain relies on a technique called device code phishing. Normally, Microsoft’s device code flow is legitimate — it lets users log in on devices without a full browser, like smart TVs or command-line tools. The attacker tricks the victim into entering a device code on a fake Microsoft login page. Once the victim does, the attacker captures the resulting authentication token.
But Forg365 goes further. It uses an AitM proxy to sit between the victim and the real Microsoft login server. This proxy captures everything: the password, the session cookie, even the one-time code from an authenticator app. The victim sees a normal login screen, but the attacker sees everything in real time. It’s a classic man-in-the-middle setup, but weaponized for scale.
AI-Assisted Lures and Antibot Measures
Forg365 doesn’t just rely on technical tricks. It also generates convincing phishing emails using AI. The service crafts lures that mimic legitimate Microsoft notifications — password expiry alerts, shared document invitations, or security warnings. These emails look real enough to fool even cautious users.
To stay under the radar, Forg365 includes antibot evasion. It checks incoming requests against known security scanners and bot IPs. If it detects a sandbox or a security researcher, it serves a harmless page. The real phishing page only loads for genuine victims. This makes detection harder for automated threat intelligence systems.
Post-Compromise: What Happens After the Login
Once an attacker has a valid session token, Forg365 doesn’t stop. It includes tools for post-compromise mailbox operations. The attacker can search emails for sensitive data, set up forwarding rules, or send phishing emails from the compromised account to the victim’s contacts. This turns a single stolen credential into a launchpad for further attacks.
The service also maintains persistence. By stealing refresh tokens, the attacker can re-authenticate even after the victim changes their password — until the token expires or is explicitly revoked. This is a critical detail for defenders: changing a password alone won’t kick out an attacker who holds a valid refresh token.
Telegram Distribution and Pricing
Forg365 operates entirely through Telegram. The service is advertised in private channels, and buyers communicate with the operator via chat. Pricing is straightforward: $400 per month or $3,800 per year. That’s a significant discount for committing to a full year — and a sign that the operators expect long-term demand.
This is not a one-off script. It’s a fully managed service. The operator handles updates, maintains the antibot filters, and likely rotates infrastructure to avoid takedowns. For a criminal group, it’s a turnkey solution. No coding required.
Defending Against Forg365 and Similar PhaaS
So how do you protect your organization? Start by understanding that traditional email filters may not catch these lures. AI-generated phishing emails can bypass signature-based detection. Here are practical steps:
- Enable conditional access policies that block device code flows from untrusted locations or devices.
- Monitor for unusual authentication patterns, especially device code logins from unexpected IPs or user agents.
- Train users to recognize fake login pages. If a page asks for a device code and then for a password, that’s a red flag.
- Use token binding where possible to tie session tokens to specific devices.
- Implement risk-based MFA — require step-up authentication for unusual logins.
Security teams should also watch for adversary-in-the-middle attack indicators like unusual certificate chains or delayed page loads. And don’t forget to revoke refresh tokens immediately when a compromise is suspected — changing a password is not enough.
Forg365 is a reminder that phishing-as-a-service is getting more sophisticated — and cheaper. For $400 a month, any attacker can launch a campaign that targets one of the most widely used enterprise platforms. Defenders need to evolve their strategies just as fast.
