# Forg365 PhaaS Targets Microsoft 365 Accounts New phishing service Forg365 targets Microsoft 365 accounts. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-07-13 - **Original article:** - **On Brifing:** https://brifing.si/s/a3b83d18-0ad9-4bf6-a52b-45aeef64d67d ## What is Forg365? Forg365 is a new phishing-as-a-service (PhaaS) operation targeting Microsoft 365 accounts. This service is distributed via Telegram and costs $400 per month or $3,800 annually. ## Phishing Tactics Forg365 uses device code phishing and adversary-in-the-middle (AitM) tactics. These methods redirect users to real Microsoft authentication pages to hijack their sessions. ## AI-Assisted Lures Forg365 enhances phishing campaigns with AI-assisted lure creation. These lures utilize legitimate email infrastructure like Amazon SES and Twilio SendGrid. ## Operator Panel Forg365 operators can access an operator panel after registering via Telegram. From this panel, they can create lures, manage campaigns, and control captured tokens. ## ForgCookie Extension Forg365 offers a Chrome extension called ForgCookie for Chromium-based browsers. This extension provides continuous access to compromised accounts and performs automatic SSO cookie refresh. ## Post-Compromise Actions Forg365 goes beyond credential harvesting by monitoring specific keywords in compromised accounts and generating AI-assisted message responses. ## Phishing Industry Forg365 lowers the skill threshold in the phishing industry while increasing operational consistency, making it easier for less experienced threat actors to run large-scale phishing campaigns. ## Sources covering this story - https://thehackernews.com/2026/07/forg365-phaas-targets-microsoft-365.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._