As reported by BleepingComputer, a newly emerged phishing-as-a-service (PhaaS) platform called Forg365 is targeting Microsoft 365 accounts by combining multiple sophisticated attack techniques into a single, accessible toolkit. At Shield53, we consider this development a significant escalation in the commoditization of advanced credential theft — and a direct challenge to organizations that believe MFA alone is sufficient protection.
Why This Is More Dangerous Than Typical Phishing Kits
Most phishing campaigns choose a lane: either they run a traditional credential harvesting page, or they deploy an adversary-in-the-middle (AiTM) proxy to intercept session tokens. Forg365 doesn't choose — it reportedly combines AiTM techniques with device code authentication abuse, a pairing that dramatically widens the attack surface. Device code phishing is particularly insidious because it exploits a legitimate OAuth workflow, making it harder for both users and security tools to recognize as malicious. When you layer AI-generated lures on top of this — producing contextually convincing, personalized phishing emails at scale — you have a toolkit that punches well above its weight class.
The AI component deserves specific attention. Historically, phishing lure quality has been a natural filter: poorly written emails catch fewer victims and get flagged more readily by email security gateways. AI-assisted lure generation erodes that natural defense, producing grammatically correct, contextually relevant content that mimics internal corporate communications. This isn't a theoretical future threat — it's operational today inside Forg365.
Who Is at Risk
The Bigger Picture: PhaaS Industrialization
Forg365 is the latest data point in a clear trend: the barrier to executing sophisticated, MFA-bypassing phishing campaigns is collapsing. Platforms like EvilProxy, Tycoon 2FA, and now Forg365 are packaging enterprise-grade attack techniques into subscription services that require little technical expertise to operate. The integration of AI lure generation marks a new chapter — adversaries can now deploy attacks that are not only technically sophisticated but also socially engineered at a quality level previously requiring skilled human operators.
Shield53 Perspective: The convergence of AiTM, device code phishing, and AI-generated content in a single PhaaS platform signals that organizations must stop treating MFA as a complete solution and start treating it as a single layer in a defense-in-depth strategy.
Shield53 Recommendations
Immediate Actions
- Transition to phishing-resistant MFA: Deploy FIDO2/WebAuthn hardware keys (YubiKey, Titan) or Microsoft's Certificate-Based Authentication. These are immune to both AiTM and device code attacks because they bind authentication to a verified origin.
- Restrict or monitor device code flows: In Microsoft Entra ID (Azure AD), review Conditional Access policies to block or restrict the Device Code OAuth grant where it isn't operationally required. This directly cuts off Forg365's device code attack vector.
- Enable Continuous Access Evaluation (CAE): CAE in Microsoft 365 allows near-real-time revocation of sessions when risk signals are detected, reducing the window an attacker has after stealing a session token via AiTM.
- Deploy token theft detection rules: Monitor for impossible travel, sign-ins from unfamiliar IPs immediately following successful MFA, and OAuth token grants to unrecognized applications — these are key AiTM indicators in your SIEM/XDR.
- Enable Microsoft Entra ID Protection: Ensure risk-based Conditional Access policies are active to flag and block risky sign-in attempts automatically.
Longer-Term Posture Improvements
- Conduct phishing simulation exercises specifically using device code lure scenarios — most employees have never encountered this vector and won't recognize it.
- Implement strict app consent policies in Entra ID to prevent unauthorized OAuth app registrations that attackers use post-compromise.
- Evaluate AI-powered email security solutions capable of detecting AI-generated phishing content through behavioral and linguistic analysis rather than signature matching alone.
- Review and harden your Microsoft 365 Secure Score with specific attention to identity and access controls.
The emergence of Forg365 is a reminder that defenders don't have the luxury of addressing one threat vector at a time. Proactive identity hygiene, phishing-resistant authentication, and behavioral monitoring are no longer optional hardening measures — they are table stakes against the current PhaaS ecosystem.
