Executive Summary
Forg365 is a sophisticated Phishing-as-a-Service (PhaaS) platform identified in late 2026 that specifically targets Microsoft 365 accounts. Distributed via Telegram for approximately $400 USD per month, the service provides attackers with automated tools for lure generation, campaign management, and token harvesting. It is notable for its ability to bypass standard security scanners by serving benign decoy content to detected VPNs, bots, and research environments while delivering malicious sign-in flows to targeted employees.
The attack chain typically begins with phishing lures sent via legitimate services like Amazon SES. Forg365 employs two primary technical branches: a device-code phishing branch that abuses genuine Microsoft Authentication Broker flows, and an Adversary-in-the-Middle (AiTM) proxy branch. Once a session is captured, the service uses a specialized browser extension called ForgCookie to clear existing cookies and inject refreshed tokens, effectively keeping stolen sessions alive indefinitely without requiring the victim's password.
This threat represents an industrialized approach to account takeover that renders traditional MFA (such as SMS or push notifications) ineffective. Organizations should prioritize phishing-resistant authentication (FIDO2) and restrict device-code authentication via Entra Conditional Access. The kit has been actively observed targeting technology, manufacturing, and financial sectors globally, with high activity levels in the United States and United Kingdom.