# Forg365 Phishing-as-a-Service Platform Uses AI-Generated Lures and AiTM/Device-Code Phishing to Compromise Microsoft 365 Accounts

> Forg365 is a phishing-as-a-service (PhaaS) platform discovered by ZeroBEC that combines adversary-in-the-middle (AiTM) session-cookie proxying and OAuth 2.0 device-code phishing with AI-generated lure content to compromise Microsoft 365 accounts. It ships a browser extension (ForgCookie) for persistent SSO token refresh, an account-intelligence operator dashboard, and antibot/sandbox-evasion protections.

- **Published:** 2026-07-10T00:00:00Z
- **Last reviewed:** 2026-07-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1161
- **ID:** TL-2026-1161
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Forg365 is a subscription-style phishing-as-a-service (PhaaS) kit reported by email-security researchers at ZeroBEC and covered by BleepingComputer on 2026-07-09. It targets Microsoft 365 (Entra ID) accounts through two parallel credential/session-theft paths operated from a single web-based operator panel.

The first path is OAuth 2.0 device-code phishing: victims are shown a Microsoft-branded 'enter this code to verify your device' page and are socially engineered into completing Microsoft's legitimate device-code authentication flow (the flow Microsoft designed for input-constrained devices such as smart TVs and IoT endpoints) against an attacker-registered device/session. Because the victim authenticates through Microsoft's real login surface, the attacker receives valid OAuth access/refresh tokens without ever touching or needing the victim's password, and the flow is largely invisible to classic phishing-page detection since no credential-harvesting form is rendered.

The second path is classic adversary-in-the-middle (AiTM) reverse-proxy phishing: Forg365 transparently proxies the authentication request/response traffic between the victim and genuine Microsoft login infrastructure, relaying MFA challenges in real time and capturing the resulting session cookies as they are issued — defeating password- and OTP-based MFA the same way kits such as Evilginx2, Tycoon 2FA, Sneaky2FA, Mamba 2FA, and Storm-1167's AiTM tooling do.

Once initial tokens/cookies are captured, the operator can install ForgCookie, a browser extension for Chrome, Edge, and Brave, on attacker-controlled or victim-reachable infrastructure. ForgCookie silently triggers repeat OAuth authorization flows using the stolen refresh tokens/session state to mint fresh Microsoft SSO cookies on demand — giving the operator durable, re-authentication-free access to the compromised mailbox and connected M365 services (SharePoint, Teams, OneDrive) well beyond the lifetime of a single stolen session cookie, and materially complicating containment because token/cookie revocation must be paired with app-consent and device-authorization review.

The operator dashboard functions as a full BEC/account-takeover console: campaign creation and phishing-link generation, OAuth application and SMTP-profile configuration for the malicious app registrations used in consent/device-code abuse, stolen-token and session-cookie management, post-compromise operational tracking, an 'account intelligence' view of compromised mailboxes, and keyword-based inbox monitoring (e.g., watching compromised mailboxes for 'invoice', 'wire', 'payment' to identify BEC opportunities). Distinctively, Forg365 integrates an AI content-generation assistant directly into this panel, letting low-skilled operators draft, iterate, and localize convincing lure emails from the same interface used to manage stolen tokens and post-compromise activity — lowering the skill and cost barrier for producing high-quality, targeted phishing lures at scale.

To resist takedown and researcher/sandbox analysis, Forg365's delivery and landing infrastructure uses AES-encrypted redirector chains, bot-detection and debugger-trap logic, sandbox/VM detection checks, VPN detection with redirection of suspected analyst/VPN traffic to benign content, and polymorphic code generation to vary kit fingerprints across deployments. Observed operational infrastructure includes Amazon SES for outbound email delivery, Cloudflare Pages for landing-page hosting, and Gophish for campaign orchestration/tracking.

ZeroBEC noted that many Forg365 capabilities overlap with other prominent PhaaS families targeting Microsoft 365 — including Kali365 and Sneaky2FA — but could not establish an infrastructure or code-sharing link tying Forg365 to those operations; Forg365 is tracked as a distinct, independent PhaaS offering. No CVE applies, as this is an abuse-of-legitimate-functionality (OAuth device-code flow, session-cookie replay) and social-engineering threat rather than a software vulnerability.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1583.006 Web Services
- T1587.001 Malware
- T1585.002 Email Accounts
- T1584.004 Server
- T1566.002 Spearphishing Link
- T1566.003 Spearphishing via Service
- T1199 Trusted Relationship
- T1204.001 Malicious Link
- T1098.003 Additional Cloud Roles
- T1176 Software Extensions
- T1528 Steal Application Access Token
- T1078.004 Cloud Accounts
- T1497 Virtualization/Sandbox Evasion
- T1027 Obfuscated Files or Information
- T1685 Disable or Modify Tools
- T1550.004 Web Session Cookie
- T1557 Adversary-in-the-Middle
- T1539 Steal Web Session Cookie
- T1111 Multi-Factor Authentication Interception
- T1552 Unsecured Credentials
- T1538 Cloud Service Dashboard
- T1087.003 Email Account
- T1550.001 Application Access Token
- T1114 Email Collection
- T1530 Data from Cloud Storage
- T1090.002 External Proxy
- T1102 Web Service
- T1657 Financial Theft
- T1598.004 Spearphishing Voice
- T1566.004 Spearphishing Voice
- T1684.001 Impersonation
- T1586.002 Email Accounts
- T1621 Multi-Factor Authentication Request Generation
- T1556.006 Multi-Factor Authentication

## Sources

- [New Forg365 phishing platform uses AI to target Microsoft 365 accounts](https://www.bleepingcomputer.com/news/security/new-forg365-phishing-platform-uses-ai-to-target-microsoft-365-accounts/)
- [Forg365 PhaaS and Fake Passkey Attacks Target Microsoft 365](https://hostdir.net/blog/new-forg365-phaas-platform-and-fake-passkey-attacks-target-microsoft-365-accounts)
- [CodeStorm Phishing Kit Evolves With Tenant-Aware M365 Replay](https://zerobec.com/blog/codestorm-phishkit-tenant-aware-m365-replay)
- [DEBULL: Storm-2372-Style Microsoft Device-Code Phishing With GraphSpy Post-Exploitation](https://zerobec.com/blog/debull-storm-2372-microsoft-device-code-phishing-graphspy)
- [DEBULL Tooling Abuses Microsoft Device-Code Flow to Target M365 Accounts](https://thehackernews.com/2026/07/debull-tooling-abuses-microsoft-device.html)
- [Device Code Phishing: The New AiTM Attack Bypassing MFA](https://spycloud.com/blog/device-code-phishing-the-new-aitm-attack-bypassing-mfa/)
- [Evolving Threat: Microsoft AiTM Phishing Attacks](https://www.proofpoint.com/us/blog/email-and-cloud-threats/aitm-phishing-attacks-evolving-threat-microsoft-365)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1161