Forg365 PhaaS: New Threat to Microsoft 365 Users

Michael Miller · 2026-07-13

A new phishing-as-a-service (PhaaS) operation called Forg365 is shaking things up in the cybersecurity world. It's targeting Microsoft 365 accounts with a nasty mix of device code phishing, adversary-in-the-middle (AitM) tactics, and AI-assisted lure creation. If you're responsible for securing Microsoft 365 in your organization, this is one you need to know about. So what makes Forg365 different from other phishing services? For starters, it's not just about stealing passwords. This service goes after session tokens, which means attackers can bypass multi-factor authentication (MFA) entirely. Once they have those tokens, they're in your account without needing a password at all. ### How Forg365 Works The attack chain is pretty sophisticated. It starts with device code phishing, where victims are tricked into entering a code on a legitimate Microsoft login page. This code gives the attacker access to the victim's session. Then, AitM techniques are used to intercept and steal authentication tokens in real time. Here's a quick breakdown of the key components: - Device code phishing: Victims are lured into entering a code that grants access - AitM session theft: Attackers intercept tokens between the user and Microsoft - AI-assisted lure creation: Phishing emails are crafted using AI to look convincing - Antibot evasion: The service avoids detection by security tools - Post-compromise mailbox operations: Once inside, attackers search for sensitive data ### The Cost of Access Forg365 is distributed through Telegram, which makes it easy for cybercriminals to get their hands on. The service costs $400 per month, or you can pay $3,800 for a full year. That's a pretty affordable price for attackers who can cause serious damage to businesses. For comparison, that's about the same as a decent laptop or a few months of cloud services. It's a low barrier to entry for anyone looking to launch targeted attacks against Microsoft 365 users. ### Why This Matters for Your Business If you're using Microsoft 365, this is a real threat. The combination of device code phishing and AitM session theft means traditional defenses like MFA aren't enough anymore. Attackers can steal tokens that let them access your email, files, and other sensitive data without triggering any alarms. Here's what you can do to protect yourself: - Educate users about device code phishing and how to spot fake login prompts - Implement conditional access policies that block unusual sign-in patterns - Use token binding to prevent stolen tokens from being reused - Monitor for suspicious activity, like unexpected mailbox access or forwarding rules ### The Bigger Picture Forg365 is part of a growing trend in phishing-as-a-service. These platforms make advanced attacks accessible to anyone with a few hundred dollars. They're constantly evolving to evade detection, which means security teams need to stay on their toes. The service also uses antibot evasion, which helps it slip past automated security scanners. And with AI-assisted lure creation, the phishing emails look more authentic than ever. It's a reminder that cybercriminals are investing in technology just as much as defenders are. ### Final Thoughts Forg365 is a serious threat, but it's not unbeatable. By understanding how it works and taking proactive steps, you can reduce your risk. Start with user education, because the human element is often the weakest link. Then layer in technical controls like conditional access and token binding. Remember, the goal isn't to make your systems impenetrable. It's to make them harder to attack than the next target. With threats like Forg365 out there, every bit of protection counts.