1. Executive summary
A new phishing-as-a-service (PhaaS) platform dubbed "Forg365" has been identified by ZeroBEC researchers, specifically targeting Microsoft 365 accounts using AI-assisted lure generation, adversary-in-the-middle (AiTM) proxying, and OAuth 2.0 device code phishing. The platform provides operators a dedicated browser extension ("ForgCookie") to maintain persistent access to compromised accounts via silent OAuth flows and cookie refreshing. Forg365 leverages legitimate infrastructure—including Amazon SES, SendGrid, and Cloudflare Pages—to bypass traditional email security gateways, posing a direct credential theft and session hijacking risk to EMEA financial services employees.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 17: ICT-related incident management process | Successful AiTM or device-code phishing leading to Microsoft 365 account compromise constitutes an ICT-related incident requiring detection, analysis, and containment. | Financial entities must ensure incident response playbooks specifically address OAuth token theft and session cookie hijacking, including immediate token revocation procedures. |
| DORA Art. 18: classification of ICT-related incidents and cyber threats | Forg365 represents a targeted cyber threat capable of bypassing MFA and enabling persistent unauthorized access to critical communication platforms. | Incidents involving this platform must be classified according to their operational impact, particularly if attacker access to executive or treasury mailboxes is confirmed. |
| NIS2 Art. 23: incident reporting obligations | Compromise of Microsoft 365 accounts via Forg365 may meet the threshold for significant incidents requiring early warning to competent CSIRTs. | Affected in-scope organisations must prepare to meet NIS2 reporting timelines if Forg365 phishing results in unauthorized access to critical systems or data. |
3. Technical analysis & attack chain
Attribution caveat: No MITRE ATT&CK threat actor profile has been resolved for the operators or developers of Forg365. Attribution is unconfirmed. Technical analysis is based on a single-sourced report from ZeroBEC as published by BleepingComputer; verify before enforcement.
Attack chain (confirmed steps)
- Initial access / lure generation: The operator uses the Forg365 dashboard to generate phishing emails. The platform integrates AI directly into the panel to craft, prepare, and refine malicious email text mimicking trusted business document notifications. Emails are sent via Amazon SES, with message bodies incorporating SendGrid-hosted images or tracking resources to blend into legitimate email traffic.
- Delivery infrastructure: Phishing landing pages are hosted on Cloudflare Pages. The platform utilizes Gophish infrastructure for campaign delivery management. An AntiBot feature protects the infrastructure using AES-encrypted redirectors, bot detection, debugger traps, sandbox checks, and polymorphic code. If a VPN connection is detected, the platform redirects the visitor to innocuous content rather than exposing the phishing page.
- Credential/Token theft via two attack paths: - Device-code phishing: The victim is shown a Microsoft-style verification code page and instructed to complete authentication using Microsoft's legitimate OAuth 2.0 device code flow (designed for input-constrained endpoints like smart TVs or IoT appliances). The victim is tricked into authorizing an attacker-controlled device. The attacker receives OAuth access and refresh tokens tied to the victim's Microsoft 365 account, bypassing MFA. - AiTM phishing: The platform proxies authentication requests and data exchanged between Microsoft infrastructure and the target account, capturing session cookies in transit.
- Post-compromise and persistence: Operators are provided a browser extension called "ForgCookie," compatible with Google Chrome, Microsoft Edge, and Brave. The extension automatically refreshes Microsoft SSO cookies. It requests account data from the Forg365 backend, clears existing session cookies, and triggers a silent OAuth flow to capture fresh cookies, providing persistent access without re-authentication.
- Data collection: The Forg365 dashboard includes an account intelligence dashboard and a keyword monitoring feature that scans compromised mailboxes for predefined terms, alerting operators when matches are detected.
Relationship to known platforms: ZeroBEC notes that many features in Forg365 are also present in the Kali365 and Sneaky2FA PhaaS platforms, though they could not establish a definitive operational connection between them.
4. Mitigation & containment
P1 — Within 24 hours
- Block delivery infrastructure: Implement email gateway rules to scrutinize Amazon SES and SendGrid-sourced messages containing Microsoft 365-themed lures (document sharing, Teams invites). Quarantine or sandbox URLs from these messages before user delivery.
- Conditional Access enforcement: In Microsoft Entra ID (Azure AD), enforce Conditional Access policies restricting authentication to compliant/managed devices only. Block authentication from unknown or unmanaged device platforms where feasible.
- Disable legacy/unnecessary device code flow: If the OAuth 2.0 device code flow is not required for business operations, disable it in the Microsoft Entra admin center to neutralize the primary Forg365 attack vector.
P2 — Within 72 hours
- Token revocation procedures: Establish and document an emergency procedure to revoke all active OAuth access tokens and refresh tokens for compromised users via the
Revoke-AzureADUserAllRefreshTokenPowerShell cmdlet or the Microsoft Graph API. - Browser extension auditing: Deploy EDR or MDM policies to inventory and block unauthorized browser extensions. Specifically search endpoints for the "ForgCookie" extension across Chrome, Edge, and Brave installations.
- Network filtering: Block known Gophish infrastructure and monitor for outbound connections to Cloudflare Pages domains hosting suspicious Microsoft authentication proxies.
P3 — Within 7 days
- User awareness training: Update phishing simulation modules to include device-code phishing scenarios (users receiving a code and being asked to enter it at a legitimate Microsoft URL) and AI-crafted business document lures.
- Mailbox monitoring: Implement mailbox auditing and alerting for anomalous inbox rule creation, external forwarding, and keyword searching behaviors consistent with the Forg365 account intelligence dashboard capabilities.
5. Indicators of compromise
No indicators of compromise available in the source material.
6. Detection
Insufficient indicators to author detection rules.
7. Sources
- BleepingComputer — New Forg365 phishing platform uses AI to target Microsoft 365 accounts — https://www.bleepingcomputer.com/news/security/new-forg365-phishing-platform-uses-ai-to-target-microsoft-365-accounts/ — 2026-07-09
- BleepingComputer — FBI warns of Kali365 phishing service targeting Microsoft 365 accounts — https://www.bleepingcomputer.com/news/security/fbi-warns-of-kali365-phishing-service-targeting-microsoft-365-accounts/
- Malwarebytes Labs — Kali365 phishing kit bypasses MFA and steals Microsoft logins — https://www.malwarebytes.com/blog/scams/2026/05/kali365-phishing-kit-bypasses-mfa-and-steals-microsoft-logins
- Dark Reading — FBI-Flagged Phishing Kit Kali365 Expands Its Reach — https://www.darkreading.com/cyber-risk/fbi-flagged-phishing-kit-kali365-expands-its-reach
8. Adverse Trace position
Forg365 represents a credible and elevated threat to EMEA financial services organizations due to its integrated AI-assisted lure generation, dual attack paths (AiTM and device-code), and built-in persistence via the ForgCookie browser extension. The platform's use of Amazon SES, SendGrid, and Cloudflare Pages infrastructure complicates detection by standard email security gateways. Attribution to a specific threat actor is unconfirmed, and the technical analysis is currently single-sourced from ZeroBEC reporting; we assess the described capabilities as plausible and consistent with observed trends in Microsoft 365 PhaaS platforms like Kali365. Adverse Trace will continue monitoring for Forg365 IOCs, dashboard leaks, and infrastructure indicators as they emerge, and will distribute them to clients as upon verification.
Published via PulseTrace — Adverse Trace threat intelligence.