Forg365 PhaaS Targets Microsoft 365 with Device Code and AitM Session Theft
Summary: A phishing-as-a-service operation called Forg365 is selling Microsoft 365 account takeover tooling over Telegram for $400 a month or $3,800 a year, combining device code phishing, adversary-in-the-middle tactics, antibot evasion, AI-assisted lure creation, and post-compromise mailbox operations. Its operator panel at logfriend[.]com covers accounts, links, OAuth app configuration, SMTP rotation, token vaulting, keyword alerts, and a ForgCookie browser extension for Chromium browsers that refreshes SSO cookies to keep access to compromised accounts.
Key Takeaway: The kit pushes victims through a real Microsoft Authentication Broker sign-in flow, so the code the user sees authorizes an attacker-controlled session - and at $400 a month, affiliates with little technical skill can run it at scale. ZeroBEC's account of one successful campaign turned on a still-active forwarding relationship from a pre-acquisition namespace, meaning the message reached the inbox looking like ordinary forwarded correspondence.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026