Forg365 PhaaS Targets Microsoft 365 with Device Code and AitM Session Theft
Forg365 PhaaS Targets Microsoft 365 with Device Code and AitM Session Theft
A new phishing-as-a-service (PhaaS) operation called Forg365 is using a combination of device code phishing, adversary-in-the-middle (AitM) tactics, antibot evasion, artificial intelligence (AI)-assisted lure creation, and post-compromise mailbox operations targeting Microsoft 365 accounts.
Distributed via Telegram and costing $400 a month (or $3,800 per year), attack chains leverage phishing lures that make use of legitimate email delivery infrastructure, such as Amazon Simple Email Service (Amazon SES) and Twilio SendGrid, to imitate a redirection chain that blends into regular email traffic before it ends in Forg365-controlled domains.
“The panel exposes a mature operator workflow: accounts, links, invitations, OAuth app configuration, redirect links, SVG generation, campaign sending, SMTP profiles, SMTP rotation, AI email generation, token vaulting, account intelligence, keyword alerts, viewer links, and browser-extension support,” ZeroBAC said.
The email security company said the PhaaS kit is best understood as similar to the Kali365 (aka Octopi365 and Freedom365) and Sneaky 2FA ecosystem, reflecting the industrialization of the business model, which is now combining bringing together lure creation, delivery, evasion, token/session handling, and post-compromise operations under a subscription-based setup that allows even threat actors with little-to-no technical expertise to orchestrate phishing campaigns with minimal effort and at scale.
Attack chains using Forg365 have been observed using business document-themed or remittance approval lures to trick recipients into clicking on malicious links. The sender domain uses Amazon SES for delivery, while the message body contains SendGrid-hosted images or tracking resources.
Customers who successfully complete Telegram registration utilize an operator panel accessible over the clearnet (“logfriend[.]com/login”), from where they can generate lures, set up campaigns, and manage captured tokens.
“Forg365 includes a device-auth phishing branch that presents a Microsoft-styled verification code page and pushes the victim into a legitimate Microsoft Authentication Broker sign-in flow,” ZeroBAC explained. “The victim sees real Microsoft authentication surfaces, but the code authorizes an attacker-controlled session.”
For AitM phishing, the platform employs route tokens, session cookies, and traffic classification to determine whether to serve phishing content or a benign decoy. If a VPN connection is detected, the kit redirects to innocuous decoy content instead of exposing the phishing pages.
A notable aspect of the Forg365 platform is that it offers an extension named ForgCookie for Chromium-based browsers like Google Chrome, Microsoft Edge, and Brave that is designed for continued access to the compromised accounts. Described as an “automatic SSO cookie refresh for Microsoft services,” the add-on acts as an intermediary between the token acquisition and browser access by cycling through the steps listed below –
- Requests account data from the Forg365 backend
- Calls the cookie-generation endpoint for a selected account
- Clears Microsoft session cookies
- Injects the generated refresh-token credential cookie into the Microsoft login domain
- Triggers a silent OAuth flow
- Captures resulting Microsoft cookies across Microsoft domains
Forg365’s extends beyond simple credential and token harvesting to facilitate a wide array of post-compromise actions, including monitoring for specific keywords in compromised email accounts and drafting a message response to a particular email thread using assistance from AI.
“The result is a platform that lowers the skill threshold while increasing operational consistency. Less experienced affiliates can use prebuilt templates, while more capable operators can customize landing pages, rotate infrastructure, manage tokens, generate cookie material, and monitor compromised accounts,” ZeroBAC said.
The disclosure coincides with the discovery of various campaigns that have been found to employ phishing kits for credential theft –
- Sending fake Microsoft account activity alerts from a legitimate-but-compromised third-party SaaS sender account to direct users to Sneaky 2FA-style phishing pages to launch a redirection chain that leads to the final phishing host, but not before performing checks to decide whether the visitor is a real user.
- Using phishing emails that direct recipients to a website hosted on Canva, which then triggers the device code phishing flow to hijack Microsoft accounts using the Kali65 phishing kit. The kit supports over 33 different lures, a payout pipeline, and a desktop application called OctoLink Live (aka Kali365 Live) that abuses the stolen token to launch a Chromium browser session and open the victim’s mailbox in OWA, OneDrive, SharePoint, or admin.microsoft.com. The platform also offers a tool known as OctoLink Sender to mass-send phishing emails from the breached account to other contacts, a technique called lateral phishing.
- Phishing campaigns using Kali365 have also distributed phishing pages impersonating Russia’s MAX messenger, indicating an attempt to single out users in Russia. “A phishing operator who can convert MAX account takeovers into propagation has access to one of the largest installed messaging bases in the Russian-speaking world,” Arctic Wolf said.
- Sending emails mimicking the IRS and Social Security Administration, alongside Adobe, Microsoft, DocuSign, and Dropbox, to deliver legitimate remote access software like ConnectWise ScreenConnect as part of phishing campaigns using a PhaaS kit called The Quarry that’s developed, maintained, and sold by a lone operator named RockyBelling. The price of the kit ranges anywhere between $500 and $3,000. This includes tools like Rocky Gmail Sender (a bulk email tool), Rocky Email Sorter (to sort email addresses by domain across Gmail, Yahoo, Hotmail, and AOL), and VioletRAT.
- Sending SMS messages impersonating the U.S. Postal Service (USPS) and UPS to trick victims into visiting a phishing page that prompts users to enter their personal and financial information under the pretext of a failed package delivery and scheduling a new delivery. “Underneath the deception, the kit captures data in real time,” Censys said. “It opens a WebSocket back to its origin and streams the victim’s card data keystroke-by-keystroke, runs a server-side BIN lookup on the card number, and pushes routing decisions (retry, PIN prompt, OTP prompt, kill-switch) back into the victim’s browser while they type.”
- Using fake bid proposal workflows to take over Google accounts using a framework called Nyasher. The redirection chain incorporates a “press-and-hold” verification page to filter out automated scanners and bots, before navigating to a blob URL. “The final page displayed a Google sign-in interface but was not reachable as a normal hosted HTML document,” ZeroBAC said. “It existed as a browser-created object URL.”
- Using bogus Google Partners and Google Premier Partner enrollment workflows in phishing emails to redirect recipients to a fake Google sign-in page designed to capture credentials in real time as part of a campaign codenamed GPPStorm.
- Using a legacy email alias to target a user’s inbox and launch a device code phishing flow that uses the EvilTokens kit. “The kit was reached through a Mailjet tracking link, then a compromised WordPress site, then a CAPTCHA interstitial, then the Cloudflare Workers host,” ZeroBAC said. “Three live infrastructure hops between the email body and the kit, none of which is the kit itself.”
To counter these threats, it’s recommended to block device code authentication unless it’s required, review mailbox artifacts after device code events for any signs of unusual activity, audit mail-flow rules, and decommission legacy aliases that no longer correspond to active employees.
“The campaign succeeded in reaching the inbox because the recipient organization still maintained an active forwarding relationship from a pre-acquisition namespace into a current mailbox,” ZeroBAC noted.
“The attacker used a still-resolvable historical identity to deliver mail that, from the SEG’s point of view, looked like normal forwarded correspondence. From the user’s point of view, the message landed in their working inbox with no visible cue that it had taken an indirect path.”
About Author
