Forg365 PhaaS Targets Microsoft 365 Accounts
New phishing service Forg365 targets Microsoft 365 accounts.
1What is Forg365?
Forg365 is a new phishing-as-a-service (PhaaS) operation targeting Microsoft 365 accounts. This service is distributed via Telegram and costs $400 per month or $3,800 annually.
2Phishing Tactics
Forg365 uses device code phishing and adversary-in-the-middle (AitM) tactics. These methods redirect users to real Microsoft authentication pages to hijack their sessions.
3AI-Assisted Lures
Forg365 enhances phishing campaigns with AI-assisted lure creation. These lures utilize legitimate email infrastructure like Amazon SES and Twilio SendGrid.
4Operator Panel
Forg365 operators can access an operator panel after registering via Telegram. From this panel, they can create lures, manage campaigns, and control captured tokens.
5ForgCookie Extension
Forg365 offers a Chrome extension called ForgCookie for Chromium-based browsers. This extension provides continuous access to compromised accounts and performs automatic SSO cookie refresh.
6Post-Compromise Actions
Forg365 goes beyond credential harvesting by monitoring specific keywords in compromised accounts and generating AI-assisted message responses.
7Phishing Industry
Forg365 lowers the skill threshold in the phishing industry while increasing operational consistency, making it easier for less experienced threat actors to run large-scale phishing campaigns.
Original article: The Hacker News — Forg365 PhaaS ile Microsoft 365 Hesapları Hedef Alınıyor