# Forg365 Phishing-as-a-Service Targets Microsoft 365 via Device Code and AitM Session Theft

> Forg365 is a Telegram-distributed, subscription-based phishing-as-a-service (PhaaS) platform that combines Microsoft OAuth device-code flow abuse, adversary-in-the-middle (AitM) session/cookie theft, a persistent Manifest V3 browser extension (ForgCookie), antibot/VPN-aware traffic filtering, and AI-assisted lure generation to compromise Microsoft 365 accounts and sustain post-compromise mailbox monitoring.

- **Published:** 2026-07-13T00:00:00Z
- **Last reviewed:** 2026-07-13T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1280
- **ID:** TL-2026-1280
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** Forg365 operators
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Forg365 is a commercially operated Phishing-as-a-Service (PhaaS) platform first documented by security researchers at ZeroBEC in July 2026 and sold via Telegram for $400/month or $3,800/year with a 5-day free trial. The operator panel, hosted at logfriend[.]com/login with backend infrastructure traced to Kyiv, Ukraine, provides a full campaign-management workflow: account and link management, invitation handling, OAuth application configuration, redirect-link generation, SVG-based lure assets, campaign send scheduling, SMTP profile configuration and rotation, AI-assisted email generation, a token vault, account intelligence dashboards, keyword-based mailbox alerting, viewer links, and browser-extension support.

Forg365 supports two primary attack branches against Microsoft 365 identities. The first abuses Microsoft's legitimate OAuth 2.0 device-code authentication flow: victims are shown a Microsoft-styled verification-code page and pushed into the genuine Microsoft Authentication Broker sign-in flow, where entering the presented code authorizes an attacker-controlled session without the victim directly disclosing credentials. Sign-in telemetry for this branch shows originalTransferMethod=deviceCodeFlow, and Entra device-registration events tied to campaign activity have used device names prefixed "Forg365-", providing a high-confidence hunting marker. The second branch is a classic adversary-in-the-middle (AitM) reverse-proxy flow using route tokens and session cookies, proxying live authentication traffic and data exchange between the victim and Microsoft identity infrastructure to capture session cookies and tokens in transit, functionally equivalent to prior Sneaky2FA/Kali365-class kits.

Initial access is delivered through phishing emails using legitimate bulk-mail infrastructure — Amazon SES for sending and Twilio SendGrid for hosted tracking images/content — with business-document and remittance-approval lure themes, chained through multiple infrastructure hops (including Cloudflare Pages for landing-page hosting and a Gophish-based delivery component) before reaching Forg365-controlled redirect branches. The kit incorporates AES-encrypted redirectors, automated bot detection, debugger traps, sandbox/anti-analysis checks, polymorphic code, and VPN-aware traffic classification that redirects suspected VPN or security-tooling traffic to benign decoy content instead of the phishing page. Human-verification friction pages reportedly reuse press-and-hold challenge components consistent with the Nyasher antibot framework used across multiple PhaaS families.

Persistence is maintained via ForgCookie, a Manifest V3 browser extension (observed version 1.0.21, compatible with Chrome, Edge, and Brave) whose runtime configuration points to logfriend[.]com as its API base. ForgCookie requests account data from the operator backend, calls a cookie-generation endpoint, clears existing Microsoft session cookies, injects refresh-token-derived credentials, and triggers a silent OAuth re-authentication flow to capture fresh Microsoft SSO cookies across domains — allowing attacker access to survive password resets via refresh-token replay without further victim interaction.

Post-compromise, Forg365 provides operators an account-intelligence dashboard with keyword-based monitoring of compromised mailboxes, AI-drafted reply generation for flagged threads (mirroring the AI-assisted business email compromise workflow documented in the related Kali365 platform, which used Anthropic's Claude to triage and reply to high-value email threads with fraudulent banking details), and direct access to victim mailboxes and cloud data via OWA, OneDrive, and SharePoint using the stolen tokens/cookies.

Forg365 is explicitly positioned by researchers as part of a broader Microsoft 365-focused PhaaS ecosystem that includes Kali365 (also marketed as Octopi365/Freedom365, subject of an FBI/IC3 public service announcement on 2026-05-21 before its operators announced closure), Sneaky2FA, The Quarry, EvilTokens, Nyasher, and GPPStorm — all sharing device-code abuse, AitM cookie theft, and AI-assisted operator tooling as common design patterns. No CVE applies; this is a commercial criminal service abusing legitimate Microsoft authentication flows and legitimate cloud email infrastructure (SES/SendGrid/Cloudflare) rather than exploiting a software vulnerability.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1583 Acquire Infrastructure
- T1587 Develop Capabilities
- T1585 Establish Accounts
- T1584 Compromise Infrastructure
- T1566 Phishing
- T1078 Valid Accounts
- T1204 User Execution
- T1176 Software Extensions
- T1098 Account Manipulation
- T1685 Disable or Modify Tools
- T1556 Modify Authentication Process
- T1497 Virtualization/Sandbox Evasion
- T1027 Obfuscated Files or Information
- T1539 Steal Web Session Cookie
- T1557 Adversary-in-the-Middle
- T1111 Multi-Factor Authentication Interception
- T1552 Unsecured Credentials
- T1538 Cloud Service Dashboard
- T1087 Account Discovery
- T1114 Email Collection
- T1213 Data from Information Repositories
- T1119 Automated Collection
- T1071 Application Layer Protocol
- T1090 Proxy
- T1657 Financial Theft

## Sources

- [Forg365 PhaaS Targets Microsoft 365 with Device Code and AitM Session Theft](https://thehackernews.com/2026/07/forg365-phaas-targets-microsoft-365.html)
- [Inside Forg365: A Telegram-Distributed Sneaky2FA-Style PhaaS Targeting Microsoft 365](https://zerobec.com/blog/inside-forg365-telegram-distributed-sneaky2fa-style-phaas)
- [New Forg365 phishing platform uses AI to target Microsoft 365 accounts](https://www.bleepingcomputer.com/news/security/new-forg365-phishing-platform-uses-ai-to-target-microsoft-365-accounts/)
- [Forg365 PhaaS Abuses Microsoft Device-Code Flow to Hijack M365 Sessions](https://cyberpress.org/forg365-phaas-abuses-microsoft-device-code-flow/)
- [Forg365 Phishing Platform Using AI to Attack Microsoft 365 Accounts](https://cybersecuritynews.com/forg365-phishing-attack-microsoft-365-accounts/)
- [Forg365 PhaaS Uses Telegram and AI Lures to Hijack Microsoft 365 Accounts](https://gbhackers.com/forg365-phaas-uses-telegram-hijack-microsoft-365-accounts/)
- [Forg365 Phishing Platform Targets Microsoft 365 Accounts With AI and Device-Code Abuse](https://windowsreport.com/forg365-phishing-platform-targets-microsoft-365-accounts-with-ai-and-device-code-abuse/)
- [Forg365 Hijacks Microsoft 365 Sessions via Device-Code Phishing](https://windowsforum.com/threads/forg365-hijacks-microsoft-365-sessions-via-device-code-phishing.436612/)
- [Mitigating Forg365 AiTM & Device-Code Phishing Against Microsoft 365: Detection, Controls, and Incident Playbook](https://cyberreplay.com/blog/mitigating-forg365-aitm-device-code-phishing-microsoft-365/)
- [Forg365 PhaaS Abuses Microsoft Device-Code Flow to Hijack M365 Sessions (IOC Radar)](https://socradar.io/free-tools/ioc-radar/reports/forg365-phaas-abuses-microsoft-device-code-flow-to-hijack-m365-sessions-c361d7a0ee8b)
- [Inside Kali365, a Device Code Phishing Ecosystem](https://www.huntress.com/blog/kali365-device-code-phishing-kit)
- [Internet Crime Complaint Center (IC3) | Kali365 Phishing-as-a-Service Kit Hijacks Microsoft 365 Access Tokens](https://www.ic3.gov/PSA/2026/PSA260521)
- [Kali365: Anatomy of a Microsoft 365 Phishing-as-a-Service Kit - From Telegram Hype to FBI Takedown Theater](https://spycloud.com/blog/kali365-anatomy-of-a-microsoft365-phishing-as-a-service-kit/)
- [Meet Kali365 — the 'Amazon of cybercrime' where hackers use AI to completely circumvent multi-factor authentication](https://www.techradar.com/pro/meet-kali365-the-amazon-of-cybercrime-where-hackers-use-ai-to-completely-circumvent-multi-factor-authentication)
- [Kali365 uses Claude AI to launch fraud from victims' own inboxes](https://www.paubox.com/blog/kali365-uses-claude-ai-to-launch-fraud-from-victims-own-inboxes)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1280