As reported by The Hacker News, a newly identified phishing-as-a-service platform called Forg365 is targeting Microsoft 365 environments using a multi-vector attack chain that layers device code phishing, adversary-in-the-middle (AitM) session interception, AI-generated lures, and automated post-compromise mailbox operations — all wrapped in a subscription model distributed via Telegram.
Why This Platform Is a Significant Escalation
Phishing-as-a-service isn't new, but Forg365 represents a meaningful maturation of the commoditized threat landscape. What distinguishes this platform isn't any single technique — device code phishing and AitM are both documented attack classes — it's the convergence of these methods into a single, low-overhead subscription toolkit available to virtually any threat actor willing to pay a monthly fee.
Device code phishing is particularly insidious in enterprise environments because it abuses Microsoft's legitimate OAuth device authorization flow. Victims are prompted to enter a short code at a Microsoft-controlled URL, which to security-conscious users may appear perfectly normal. By the time the victim authenticates, the attacker has already captured a valid, MFA-bypassing token. There is no credential to steal in the traditional sense — the attacker receives a fully authenticated session.
Layering AitM on top of this means Forg365 operators can intercept and replay session tokens even in environments where conditional access policies or phishing-resistant MFA is assumed to provide protection. Traditional MFA offers little meaningful defense here.
The AI-Assisted Lure Problem
The integration of AI-assisted lure generation deserves particular attention from defenders. For years, poorly written phishing emails — awkward grammar, mismatched branding, suspicious urgency — served as reasonable detection signals for trained users. AI-generated lures erode this heuristic significantly. When the phishing email reads as fluently as legitimate internal communications, user-awareness training that focuses on language quality as a signal becomes substantially less effective.
Combined with antibot evasion capabilities, Forg365 is also designed to defeat automated scanning pipelines. Secure email gateways and URL reputation engines that rely on crawling phishing pages to generate verdicts may be rendered blind by these evasion layers, increasing dwell time before detection and block.
Post-Compromise Mailbox Operations: The Silent Phase
Perhaps the most underappreciated component of Forg365 is its reported post-compromise mailbox automation. Once a token is captured, many organizations have limited visibility into what happens next — particularly in environments without robust Microsoft Purview audit logging or Microsoft Sentinel integration. Automated mailbox rules, data exfiltration, lateral phishing from trusted internal addresses, and business email compromise (BEC) pivots can all be executed rapidly and quietly using the stolen session.
This post-access phase is where financial and reputational damage typically materializes, and it is the phase most likely to evade detection in under-monitored Microsoft 365 tenants.
Who Is Most Exposed
Organizations at elevated risk include:
Shield53 Recommendations
Immediate Actions
- Block device code flow at the tenant level. In Microsoft Entra ID Conditional Access, create a policy that blocks the
urn:ietf:params:oauth:grant-type:device_codeauthentication flow for all users unless there is a documented operational requirement. Most enterprise users have no legitimate need for this flow. - Deploy phishing-resistant MFA. Migrate high-value accounts — executives, finance, IT administrators — to FIDO2 hardware keys or Windows Hello for Business. These are resistant to both device code and AitM attacks because authentication is origin-bound.
- Enable and monitor Unified Audit Log in Microsoft 365. Specifically alert on: anomalous OAuth token grants, new inbox rules created shortly after authentication, sign-ins from unexpected geographic locations or ASNs, and mailbox access from non-primary client applications.
- Review Conditional Access policies for token session controls. Implement token binding and continuous access evaluation (CAE) to reduce the window in which stolen tokens remain valid.
- Integrate Microsoft Entra ID Sign-In Logs with your SIEM. Build detection rules for device code authentication events originating from unexpected devices or locations.
Longer-Term Posture Improvements
- Re-evaluate user awareness training to de-emphasize grammar/language quality as a phishing indicator and instead focus on behavioral signals: unexpected requests, urgency, unusual sender context.
- Conduct purple team exercises specifically simulating AitM and device code phishing against your Microsoft 365 environment to validate detection coverage.
- Evaluate email security vendors' ability to detect AI-generated lures and AitM-hosted phishing infrastructure, as capability gaps are widening rapidly in this area.
Shield53 Perspective: The $400/month price point is the real story here. Sophisticated, MFA-bypassing, AI-enhanced Microsoft 365 account theft is no longer the exclusive domain of nation-state actors or well-resourced criminal groups. It is now a commodity service. Defenders cannot assume that attack sophistication will provide any filtering effect on who targets them. Treat every Microsoft 365 tenant as a high-value target and harden accordingly.
