Forg365 is a mature phishing-as-a-service platform designed to steal Microsoft 365 accounts by leveraging AI to generate phishing lures and combining two main attack vectors: device-code phishing and adversary-in-the-middle (AiTM) phishing. The platform includes a comprehensive dashboard for campaign management, OAuth app configuration, token management, and AI-assisted email crafting. It uses legitimate cloud services such as Amazon SES for email delivery and Cloudflare Pages for hosting phishing landing pages, enhancing its stealth. Forg365 also provides a browser extension, ForgCookie, to maintain persistent access by automatically refreshing Microsoft SSO cookies. The device-code phishing method abuses Microsoft's OAuth 2.0 device code flow to trick victims into authorizing attacker-controlled devices, while AiTM phishing proxies authentication requests to capture session cookies. Anti-bot and anti-analysis features prevent researchers from accessing the platform and detecting phishing pages. The platform's integration of AI reduces the cost and complexity of creating customized phishing campaigns and managing post-compromise activities.

Successful exploitation results in theft of Microsoft 365 account credentials and persistent unauthorized access to associated services without requiring re-authentication. This enables attackers to access sensitive business documents, emails, and other resources within compromised accounts. The use of AI-assisted lure generation increases the likelihood of successful phishing by producing convincing and tailored emails. The persistent access facilitated by the ForgCookie browser extension allows attackers to maintain control over accounts even after initial compromise. The platform's use of legitimate cloud services and anti-analysis techniques complicates detection and response efforts.

There is no patch applicable as this is a phishing platform rather than a software vulnerability. Users and administrators should restrict or disable Microsoft device-code authentication unless it is strictly required. Monitoring Microsoft Entra logs for device-code authentication events, mailbox rules, new device sign-ins, Microsoft Authentication Broker activity, and OAuth grants is recommended to detect suspicious activity. If compromise is suspected, all tokens and sessions should be revoked and refreshed immediately. Organizations should educate users about phishing risks and the specific tactics used by Forg365. No vendor advisory or official fix is available; mitigation relies on detection, monitoring, and user awareness.