New Forg365 Phishing Platform Uses AI to Steal Microsoft 365 Accounts

Cybersecurity specialists have uncovered a new phishing platform called Forg365, which operates on a phishing-as-a-service (PhaaS) model and is aimed at stealing Microsoft 365 accounts.

How the service works

Forg365 combines two techniques for bypassing standard account protection: adversary-in-the-middle (AiTM) attacks, which make it possible to intercept session tokens and get around multi-factor authentication, and the device code method, which exploits the browserless device authorization mechanism.

A distinctive feature of the platform is its use of artificial intelligence to automatically generate phishing lures. This allows the service's operators to quickly create convincing messages and pages that mimic legitimate Microsoft 365 notifications, lowering the barrier to entry for attackers who lack technical skills.

The phishing-as-a-service model

Like other services of this kind, Forg365 provides ready-made infrastructure for running phishing campaigns on behalf of third parties for a fee. This model considerably simplifies the organization of attacks and contributes to their widespread proliferation, since it does not require customers to have deep knowledge of information security.

The platform's emergence reflects a broader trend of recent years — the growing number of PhaaS services targeting corporate Microsoft 365 accounts, which remain one of attackers' primary targets due to the ecosystem's wide adoption in the business environment.

Researchers stress that the combination of AiTM attacks and the device code method makes such campaigns especially dangerous, because it allows attackers to bypass the multi-factor authentication measures that organizations have traditionally relied on to protect their accounts.

Experts recommend that organizations pay attention to unusual device authorization requests and use additional protection mechanisms that are resistant to session token interception.

Source: Bleeping Computer