Rogue Forg365-Prefixed Device Registrations in Entra ID

Ethan Andrews@eandrews

•updated Jul 9, 2026•17•0•37

Detects new device registrations in Microsoft Entra ID where the device display name is prefixed with 'Forg365-', a pattern used by the Forg365 PhaaS (Phishing-as-a-Service) platform. This activity is indicative of an adversary establishing persistent, unmanaged device access to compromised Microsoft 365 accounts.