Forg365: Telegram-Distributed Phishing-as-a-Service Abusing Microsoft Device-Code Flow and AiTM to Hijack Microsoft 365/Entra Sessions
Forg365: Telegram-Distributed Phishing-as-a-Service Abusing (TL-2026-1202), also tracked as Forg365 PhaaS, is a high-severity phishing campaign, first published 2026-07-11. It is attributed to Forg365 operators with low confidence, affects Microsoft Microsoft 365 / Entra ID (Azure AD), maps to 28 MITRE ATT&CK techniques (T1027, T1071, T1087), and is covered by 9 detection rules and 16 indicators of compromise.
Key facts for TL-2026-1202
- Threat ID
- TL-2026-1202
- Also known as
- Forg365 PhaaS
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- 2026-07-11
- Last reviewed
- 2026-07-11
- Attribution
- Forg365 operators
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, finance, professional-services, government administration, health, education, manufacturing
- Target regions
- North America, Europe, Global
- Detection rules
- 9
- Indicators of compromise
- 16
Malware and tooling in Forg365: Telegram-Distributed Phishing-as-a-Service Abusing
Malware and tooling: Forg365, Kali365, ForgCookie, Gophish
Forg365 is a commercial phishing-as-a-service (PhaaS) platform distributed via Telegram ($400/month, $3,800/year) that steals Microsoft 365/Entra ID session tokens and cookies through two attack paths: OAuth 2.0 device-code flow abuse and adversary-in-the-middle (AiTM) proxying. Its ForgCookie browser extension (Chrome/Edge/Brave) silently refreshes stolen Microsoft SSO cookies to survive password resets, while an AI-assisted lure generator and AntiBot evasion layer (VPN redirection, debugger traps, polymorphic code) round out the kit.
How Forg365: Telegram-Distributed Phishing-as-a-Service Abusing works
Forg365 is a subscription-based phishing-as-a-service (PhaaS) operation, first documented by researchers at ZeroBEC and subsequently reported by Cybersecurity News, BleepingComputer, CyberPress, GBHackers, and Windows Report in July 2026, that specifically targets Microsoft 365 and Entra ID (Azure AD) accounts. The platform is sold entirely through Telegram with a five-day free trial, $400/month, or $3,800/year subscription tiers, and provides a full operator dashboard for campaign management, OAuth application/SMTP configuration, token and cookie management, and AI-assisted phishing-email generation.
Forg365 supports two primary attack chains. The first, and the one researchers describe as the trending technique, abuses Microsoft's legitimate OAuth 2.0 device-code authentication flow (designed for input-constrained devices such as smart TVs and IoT appliances): victims are shown a Microsoft-styled verification-code page and are guided through the genuine Microsoft sign-in/device-authorization surface, unknowingly authorizing an attacker-controlled device/session. Because the victim interacts with authentic Microsoft infrastructure and never enters a password into a fake page, this bypasses many classic anti-phishing controls and does not require credential capture at all — Entra logs the event as `originalTransferMethod=deviceCodeFlow` with an attacker-registered device typically named with a "Forg365-" prefix.
The second attack path is a classical adversary-in-the-middle (AiTM) reverse-proxy phishing flow: Forg365 sits between the victim and Microsoft's real authentication endpoints, relaying credentials and MFA challenges in real time and capturing the resulting session cookies, access tokens, and refresh tokens — defeating password-based MFA that does not bind sessions to a client (i.e., non-phishing-resistant MFA).
Persistence is provided by ForgCookie, a companion browser extension compatible with Chrome, Edge, and Brave. ForgCookie requests account data from the Forg365 backend, clears the victim's existing Microsoft SSO session cookies, and triggers a silent (headless) OAuth re-authentication flow using the previously captured refresh token, capturing freshly issued SSO cookies without any victim interaction. This lets the attacker's browser session remain synchronized with a valid Microsoft session indefinitely, and the access effectively survives the victim's password changes, since the underlying OAuth refresh token — not the password — is what is being replayed.
An integrated AI lure-generation feature lets operators generate phishing emails, invoices, business documents, fake voicemail notifications, and password-reset messages directly from the panel, with templates impersonating SharePoint, OneDrive, DocuSign, and Adobe Acrobat Sign, removing the need for external AI tooling or manual lure authoring.
Delivery infrastructure abuses legitimate cloud services to improve deliverability and evade reputation-based blocking: Amazon SES and SendGrid for outbound email/tracking pixels, Cloudflare Pages for phishing landing pages, and a Gophish-based backend for campaign orchestration and click tracking. An AntiBot/evasion layer — described as using AES-encrypted redirectors, bot detection, debugger traps, sandbox checks, and polymorphic code — is designed to block security researchers and automated scanners from reaching the live phishing content; traffic identified as originating from VPN exit nodes is redirected to a benign decoy page instead of the phishing kit.
Observed operator/back-end infrastructure includes the panel domain logfriend[.]com (hosted with an operations presence reported in Kyiv, Ukraine) and at least one instance of device-code phishing activity originating from a Comcast/Xfinity residential IP address in the United States, suggesting either a residential-proxy relay or a US-based operator/reseller. Researchers found feature and workflow overlap with existing PhaaS families Kali365 and Sneaky2FA (also called "Sneaky 2FA"), but no confirmed shared operator or infrastructure link between Forg365 and either family has been established.
A compromised session/token grants an attacker the ability to read and exfiltrate email, search and download from SharePoint document libraries, impersonate the victim in Microsoft Teams, and pivot further via Microsoft Graph API calls — all without needing the victim's password, and the compromise can persist silently for hours or days because the token, not the password, is the object of value. Recommended defensive controls center on restricting or disabling the OAuth 2.0 device-code authentication flow via Entra Conditional Access unless it is operationally required, hunting for `deviceCodeFlow` in Entra ID sign-in logs, alerting on device registrations matching the "Forg365-*" naming pattern, auditing OAuth application consent grants and mailbox rule changes, and immediately revoking sessions/refresh tokens and forcing token re-issuance when compromise is suspected (a password reset alone is insufficient).
MITRE ATT&CK techniques used in TL-2026-1202
Defense Evasion
T1027 Obfuscated Files or Information; T1497 Virtualization/Sandbox Evasion
Command and Control
T1071 Application Layer Protocol; T1090 Proxy; T1102 Web Service
Discovery
T1087 Account Discovery; T1526 Cloud Service Discovery
Persistence
T1098 Account Manipulation; T1137 Office Application Startup; T1176 Software Extensions
Credential Access
T1111 Multi-Factor Authentication Interception; T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1557 Adversary-in-the-Middle
Collection
T1114 Email Collection; T1119 Automated Collection; T1213 Data from Information Repositories
Impact
lateral-movement
T1550 Use Alternate Authentication Material
Lateral Movement
T1550 Use Alternate Authentication Material
defense-impairment
T1556 Modify Authentication Process; T1685 Disable or Modify Tools
Initial Access
Exfiltration
T1567 Exfiltration Over Web Service
Resource Development
T1583 Acquire Infrastructure; T1584 Compromise Infrastructure; T1587 Develop Capabilities; T1588 Obtain Capabilities
Reconnaissance
Affected products and versions in Forg365: Telegram-Distributed Phishing-as-a-Service Abusing
- Microsoft — Microsoft 365 / Entra ID (Azure AD)
Vulnerable versions: all tenants with device-code authentication flow enabled - Microsoft — Microsoft Graph API
Vulnerable versions: accessible via stolen OAuth access/refresh tokens
Remediation for Forg365: Telegram-Distributed Phishing-as-a-Service Abusing
Immediate actions
- Block or restrict the OAuth 2.0 device-code authentication flow via Entra ID Conditional Access unless explicitly required for input-constrained devices
- Search Microsoft Entra sign-in logs for originalTransferMethod=deviceCodeFlow events tied to unfamiliar or newly registered devices
- Alert on and quarantine device registrations whose display name matches the pattern "Forg365-*"
- Revoke all active sessions and refresh tokens for any account suspected of compromise (a password reset alone does not remove attacker access)
- Block outbound/inbound traffic to and from the known operator panel domain logfriend[.]com
- Audit and revoke unauthorized OAuth application consent grants in Microsoft Entra / Microsoft 365 admin center
- Review mailbox rules, forwarding rules, and Teams/SharePoint sharing activity for signs of post-compromise data collection
Workarounds
- Disable the Microsoft Authentication Broker device-code flow tenant-wide if not used by any legitimate input-constrained devices
- Require managed-device/Conditional Access compliance checks before allowing device-code authentication to succeed
Longer-term hardening
- Migrate users toward phishing-resistant, FIDO2/WebAuthn-based authentication (passkeys) to neutralize AiTM cookie/token theft
- Deploy browser-extension allowlisting/DLP to detect and block unauthorized extensions such as ForgCookie
- Implement continuous access evaluation (CAE) and token binding/Conditional Access session controls to shorten the useful life of stolen tokens
- Deploy anti-phishing email security with sandboxing resistant to bot-detection/VPN-cloaking evasion
- User awareness training specifically covering device-code phishing (distinct from classic password-phishing awareness)
Weaknesses (CWE) in Forg365: Telegram-Distributed Phishing-as-a-Service Abusing
CWE-294, CWE-287, CWE-346
Timeline of Forg365: Telegram-Distributed Phishing-as-a-Service Abusing
- Device-code flow abuse becomes an increasingly prevalent technique across unrelated PhaaS kits (including EvilTokens and Kali365) through early 2026, establishing the tradecraft Forg365 later productizes
- FBI IC3 issues an advisory on Kali365, a separate but feature-overlapping PhaaS platform distributing Microsoft 365 OAuth token-stealing kits via Telegram, months before Forg365 is documented
- BleepingComputer publishes coverage of the newly identified Forg365 PhaaS platform based on ZeroBEC's investigation of AI-generated business-document phishing emails
- Device-code phishing activity observed originating from a Comcast/Xfinity residential IP address in the United States
- Operator panel domain logfriend[.]com identified, with backend operations presence reported in Kyiv, Ukraine
- Researchers note operational and feature overlap with existing PhaaS families Kali365 and Sneaky2FA, without establishing a confirmed operator link
- CyberPress, GBHackers, and Windows Report publish follow-up coverage of Forg365 based on ZeroBEC's findings
- ZeroBEC researchers publish initial analysis of the Forg365 PhaaS platform, detailing device-code phishing, AiTM flow, and the ForgCookie extension
- CyberReplay publishes an incident-response and detection playbook for Forg365 AiTM and device-code phishing against Microsoft 365 tenants
- Cybersecurity News and Windows News publish additional coverage of the Forg365 campaign and its Telegram-based distribution model
Sources cited for Forg365: Telegram-Distributed Phishing-as-a-Service Abusing
- Forg365 phishing attack targets Microsoft 365 accounts
- New Forg365 phishing platform uses AI to target Microsoft 365 accounts
- Forg365 PhaaS Abuses Microsoft Device-Code Flow to Hijack M365 Sessions
- Inside Forg365: A Telegram-Distributed Sneaky 2FA-Style PhaaS Targeting Microsoft 365
- Forg365 PhaaS Uses Telegram and AI Lures to Hijack Microsoft 365 Accounts
- Forg365 Phishing Platform Targets Microsoft 365 Accounts With AI and Device-Code Abuse
- Mitigating Forg365 AiTM & Device-Code Phishing Against Microsoft 365: Detection, Controls, and Incident Playbook
- New Forg365 phishing platform uses AI to target Microsoft 365 accounts (Threat Radar)
- New Forg365 PhaaS Platform and Fake Passkey Attacks Target Microsoft 365 Accounts
- Telegram Phishing Service 'Forg365' Exploits Microsoft's Device Code Flow to Steal Sessions
- Two New Microsoft 365 Threats Emerge as Helix Vishing Group and Forg365 Phishing Platform Target Corporate Accounts
Threats related to Forg365: Telegram-Distributed Phishing-as-a-Service Abusing
- Forg365 Phishing-as-a-Service Targets Microsoft 365 via Device Code and AitM Session Theft
- ARToken PhaaS Platform Exposes EvilTokens-Affiliated Microsoft 365 Device Code Phishing Toolkit
- EvilTokens/ARToken Device-Code Phishing Kit Bypasses MFA to Compromise Microsoft 365 Accounts
- Three PhaaS Kits (Sneaky 2FA, EvilTokens, EvilProxy) Targeting US Organizations to Steal M365 Credentials and Session Tokens
- Tycoon 2FA Adversary-in-the-Middle Phishing-as-a-Service (Storm-1747) — MFA-Bypass Kit Targeting Microsoft 365 & Gmail
Detection coverage for TL-2026-1202
As of 2026-07-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1202 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.