Researchers Detail Forg365 Phishing Platform Targeting Microsoft 365 Accounts
Summary
ZeroBEC researchers detail Forg365, a phishing platform combining device-code and AiTM attacks with AI-generated lures. Its ForgCookie extension is designed to refresh Microsoft SSO cookies and maintain access to compromised accounts.
Key points
- Researchers obtained access to the Forg365 dashboard, which supports campaign setup, OAuth and SMTP configuration, token management, and AI-assisted email generation.
- Forg365 uses device-code phishing to trick victims into authorizing an attacker-controlled device through Microsoft’s OAuth flow.
- Its AiTM method proxies authentication traffic and captures session cookies, according to the researchers.
- The ForgCookie browser extension requests account data, clears session cookies, and triggers a silent OAuth flow to obtain fresh cookies for continued access.
- The platform reportedly uses bot detection, debugger and sandbox checks, encrypted redirectors, and VPN-aware redirection to evade analysis.
- Researchers report delivery infrastructure involving Amazon SES, Cloudflare Pages, and Gophish.
- Recommended defenses include restricting device-code authentication where possible, monitoring Entra logs and OAuth grants, and revoking tokens and sessions if compromise is suspected.
Article Details
- Attack Vectors
- Forg365 uses device-code phishing to trick victims into authorizing an attacker-controlled device through Microsoft's OAuth 2.0 device-code flow.
- Its AiTM method proxies authentication requests and responses to capture session cookies.
- Forg365 generates customized phishing email content with AI and supports managing phishing campaigns and links.
- The ForgCookie browser extension requests account data from the Forg365 backend, clears session cookies, and triggers a silent OAuth flow to obtain fresh Microsoft SSO cookies for continued access.
- Researchers report phishing email delivery through Amazon SES and Gophish, with landing pages hosted on Cloudflare Pages.
- Forg365 uses bot detection, debugger traps, sandbox checks, encrypted redirectors, polymorphic code, and VPN-aware redirection to impede analysis.
- Defensive Notes
- Restrict or disable Microsoft device-code authentication unless it is required.
- Monitor Microsoft Entra logs for unexpected device-code authentication events.
- Investigate unexpected mailbox rules, new device sign-ins, Microsoft Authentication Broker activity, and OAuth grants.
- If compromise is suspected, revoke and refresh all tokens and sessions as soon as possible.
MITRE ATT&CK
T1114.002 · Remote Email CollectionForg365's keyword-monitoring feature scans compromised mailboxes for predefined terms and alerts operators when they match.T1497.001 · System ChecksThe platform uses sandbox checks as part of its defenses against analysis.T1528 · Steal Application Access TokenDevice-code phishing tricks victims into authorizing an attacker-controlled device through OAuth 2.0.T1539 · Steal Web Session CookieThe AiTM flow captures session cookies, and ForgCookie obtains fresh Microsoft SSO cookies.T1550.004 · Web Session CookieForgCookie uses refreshed Microsoft SSO cookies to maintain access to services associated with compromised accounts.T1557.003 · DHCP SpoofingForg365 proxies authentication requests and exchanged data between Microsoft infrastructure and the target account in its AiTM phishing path.T1566.002 · Spearphishing LinkThe operation sends phishing emails and manages phishing links that lead to phishing pages.T1622 · Debugger EvasionThe platform's AntiBot defenses include debugger traps.
Vendors
AmazonResearchers observed phishing delivery through Amazon SES, Cloudflare Pages, and Gophish infrastructure.CloudflareResearchers observed phishing delivery through Amazon SES, Cloudflare Pages, and Gophish infrastructure.MicrosoftForg365 is a new phishing-as-a-service operation that targets Microsoft 365 accounts using device-code phishing, AiTM techniques, and AI-generated lure content.
Products
Microsoft 365 Apps for EnterpriseForg365 is a new phishing-as-a-service operation that targets Microsoft 365 accounts using device-code phishing, AiTM techniques, and AI-generated lure content.Microsoft EntraUsers are recommended to restrict or disable Microsoft device-code authentication unless required and to monitor Microsoft Entra logs for device-code authentication events.
Tools
Forg365Forg365 is a new phishing-as-a-service operation that targets Microsoft 365 accounts using device-code phishing, AiTM techniques, and AI-generated lure content.ForgCookieIt also uses the ForgCookie browser extension to maintain persistent access to Microsoft services after compromise.GophishResearchers observed phishing delivery through Amazon SES, Cloudflare Pages, and Gophish infrastructure.