# Forg365: Telegram-Distributed Phishing-as-a-Service Abusing Microsoft Device-Code Flow and AiTM to Hijack Microsoft 365/Entra Sessions

> Forg365 is a commercial phishing-as-a-service (PhaaS) platform distributed via Telegram ($400/month, $3,800/year) that steals Microsoft 365/Entra ID session tokens and cookies through two attack paths: OAuth 2.0 device-code flow abuse and adversary-in-the-middle (AiTM) proxying. Its ForgCookie browser extension (Chrome/Edge/Brave) silently refreshes stolen Microsoft SSO cookies to survive password resets, while an AI-assisted lure generator and AntiBot evasion layer (VPN redirection, debugger traps, polymorphic code) round out the kit.

- **Published:** 2026-07-11T00:00:00Z
- **Last reviewed:** 2026-07-11T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1202
- **ID:** TL-2026-1202
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Actor:** Forg365 operators
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Forg365 is a subscription-based phishing-as-a-service (PhaaS) operation, first documented by researchers at ZeroBEC and subsequently reported by Cybersecurity News, BleepingComputer, CyberPress, GBHackers, and Windows Report in July 2026, that specifically targets Microsoft 365 and Entra ID (Azure AD) accounts. The platform is sold entirely through Telegram with a five-day free trial, $400/month, or $3,800/year subscription tiers, and provides a full operator dashboard for campaign management, OAuth application/SMTP configuration, token and cookie management, and AI-assisted phishing-email generation.

Forg365 supports two primary attack chains. The first, and the one researchers describe as the trending technique, abuses Microsoft's legitimate OAuth 2.0 device-code authentication flow (designed for input-constrained devices such as smart TVs and IoT appliances): victims are shown a Microsoft-styled verification-code page and are guided through the genuine Microsoft sign-in/device-authorization surface, unknowingly authorizing an attacker-controlled device/session. Because the victim interacts with authentic Microsoft infrastructure and never enters a password into a fake page, this bypasses many classic anti-phishing controls and does not require credential capture at all — Entra logs the event as `originalTransferMethod=deviceCodeFlow` with an attacker-registered device typically named with a "Forg365-" prefix.

The second attack path is a classical adversary-in-the-middle (AiTM) reverse-proxy phishing flow: Forg365 sits between the victim and Microsoft's real authentication endpoints, relaying credentials and MFA challenges in real time and capturing the resulting session cookies, access tokens, and refresh tokens — defeating password-based MFA that does not bind sessions to a client (i.e., non-phishing-resistant MFA).

Persistence is provided by ForgCookie, a companion browser extension compatible with Chrome, Edge, and Brave. ForgCookie requests account data from the Forg365 backend, clears the victim's existing Microsoft SSO session cookies, and triggers a silent (headless) OAuth re-authentication flow using the previously captured refresh token, capturing freshly issued SSO cookies without any victim interaction. This lets the attacker's browser session remain synchronized with a valid Microsoft session indefinitely, and the access effectively survives the victim's password changes, since the underlying OAuth refresh token — not the password — is what is being replayed.

An integrated AI lure-generation feature lets operators generate phishing emails, invoices, business documents, fake voicemail notifications, and password-reset messages directly from the panel, with templates impersonating SharePoint, OneDrive, DocuSign, and Adobe Acrobat Sign, removing the need for external AI tooling or manual lure authoring.

Delivery infrastructure abuses legitimate cloud services to improve deliverability and evade reputation-based blocking: Amazon SES and SendGrid for outbound email/tracking pixels, Cloudflare Pages for phishing landing pages, and a Gophish-based backend for campaign orchestration and click tracking. An AntiBot/evasion layer — described as using AES-encrypted redirectors, bot detection, debugger traps, sandbox checks, and polymorphic code — is designed to block security researchers and automated scanners from reaching the live phishing content; traffic identified as originating from VPN exit nodes is redirected to a benign decoy page instead of the phishing kit.

Observed operator/back-end infrastructure includes the panel domain logfriend[.]com (hosted with an operations presence reported in Kyiv, Ukraine) and at least one instance of device-code phishing activity originating from a Comcast/Xfinity residential IP address in the United States, suggesting either a residential-proxy relay or a US-based operator/reseller. Researchers found feature and workflow overlap with existing PhaaS families Kali365 and Sneaky2FA (also called "Sneaky 2FA"), but no confirmed shared operator or infrastructure link between Forg365 and either family has been established.

A compromised session/token grants an attacker the ability to read and exfiltrate email, search and download from SharePoint document libraries, impersonate the victim in Microsoft Teams, and pivot further via Microsoft Graph API calls — all without needing the victim's password, and the compromise can persist silently for hours or days because the token, not the password, is the object of value. Recommended defensive controls center on restricting or disabling the OAuth 2.0 device-code authentication flow via Entra Conditional Access unless it is operationally required, hunting for `deviceCodeFlow` in Entra ID sign-in logs, alerting on device registrations matching the "Forg365-*" naming pattern, auditing OAuth application consent grants and mailbox rule changes, and immediately revoking sessions/refresh tokens and forcing token re-issuance when compromise is suspected (a password reset alone is insufficient).

## MITRE ATT&CK

- T1566 Phishing
- T1528 Steal Application Access Token
- T1539 Steal Web Session Cookie
- T1557 Adversary-in-the-Middle
- T1111 Multi-Factor Authentication Interception
- T1556 Modify Authentication Process
- T1550 Use Alternate Authentication Material
- T1497 Virtualization/Sandbox Evasion
- T1027 Obfuscated Files or Information
- T1685 Disable or Modify Tools
- T1176 Software Extensions
- T1098 Account Manipulation
- T1137 Office Application Startup
- T1102 Web Service
- T1090 Proxy
- T1071 Application Layer Protocol
- T1114 Email Collection
- T1213 Data from Information Repositories
- T1119 Automated Collection
- T1526 Cloud Service Discovery
- T1087 Account Discovery
- T1550 Use Alternate Authentication Material
- T1567 Exfiltration Over Web Service
- T1531 Account Access Removal
- T1583 Acquire Infrastructure
- T1584 Compromise Infrastructure
- T1587 Develop Capabilities
- T1588 Obtain Capabilities
- T1589 Gather Victim Identity Information

## Sources

- [Forg365 phishing attack targets Microsoft 365 accounts](https://cybersecuritynews.com/forg365-phishing-attack-microsoft-365-accounts/)
- [New Forg365 phishing platform uses AI to target Microsoft 365 accounts](https://www.bleepingcomputer.com/news/security/new-forg365-phishing-platform-uses-ai-to-target-microsoft-365-accounts/)
- [Forg365 PhaaS Abuses Microsoft Device-Code Flow to Hijack M365 Sessions](https://cyberpress.org/forg365-phaas-abuses-microsoft-device-code-flow/)
- [Inside Forg365: A Telegram-Distributed Sneaky 2FA-Style PhaaS Targeting Microsoft 365](https://zerobec.com/blog/inside-forg365-telegram-distributed-sneaky2fa-style-phaas)
- [Forg365 PhaaS Uses Telegram and AI Lures to Hijack Microsoft 365 Accounts](https://gbhackers.com/forg365-phaas-uses-telegram-hijack-microsoft-365-accounts/)
- [Forg365 Phishing Platform Targets Microsoft 365 Accounts With AI and Device-Code Abuse](https://windowsreport.com/forg365-phishing-platform-targets-microsoft-365-accounts-with-ai-and-device-code-abuse/)
- [Mitigating Forg365 AiTM & Device-Code Phishing Against Microsoft 365: Detection, Controls, and Incident Playbook](https://cyberreplay.com/blog/mitigating-forg365-aitm-device-code-phishing-microsoft-365/)
- [New Forg365 phishing platform uses AI to target Microsoft 365 accounts (Threat Radar)](https://radar.offseq.com/threat/new-forg365-phishing-platform-uses-ai-to-target-mi-86bd09b805336061)
- [New Forg365 PhaaS Platform and Fake Passkey Attacks Target Microsoft 365 Accounts](https://hostdir.net/blog/new-forg365-phaas-platform-and-fake-passkey-attacks-target-microsoft-365-accounts)
- [Telegram Phishing Service 'Forg365' Exploits Microsoft's Device Code Flow to Steal Sessions](https://windowsnews.ai/article/telegram-phishing-service-forg365-exploits-microsofts-device-code-flow-to-steal-sessions.436612)
- [Two New Microsoft 365 Threats Emerge as Helix Vishing Group and Forg365 Phishing Platform Target Corporate Accounts](https://www.techechelon.com/post/two-new-microsoft-365-threats-emerge-as-helix-vishing-group-and-forg365-phishing-platform-target)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1202