Forg365 PhaaS Targets Microsoft 365 with Device Code and AitM Session Theft

Distributed via Telegram and costing $400 a month (or $3,800 per year), attack chains leverage phishing lures that make use of legitimate email delivery infrastructure, such as Amazon Simple Email Service (Amazon SES) and Twilio SendGrid, to imitate a redirection chain that blends into regular email traffic before it ends in Forg365controlled domains.

"The panel exposes a mature operator workflow: accounts, links, invitations, OAuth app configuration, redirect links, SVG generation, campaign sending, SMTP profiles, SMTP rotation, AI email generation, token vaulting, account intelligence, keyword alerts, viewer links, and browserextension support," ZeroBAC said.

The email security company said the PhaaS kit is best understood as similar to the Kali365 (aka Octopi365 and Freedom365) and Sneaky 2FA ecosystem, reflecting the industrialization of the business model, which is now combining bringing together lure creation, delivery, evasion, token/session handling, and postcompromise operations under a subscriptionbased setup that allows even threat actors with littletono technical expertise to orchestrate phishing campaigns with minimal effort and at scale.

Attack chains using Forg365 have been observed using business documentthemed or remittance approval lures to trick recipients into clicking on malicious links. The sender domain uses Amazon SES for delivery, while the message body contains SendGridhosted images or tracking resources.

Customers who successfully complete Telegram registration utilize an operator panel accessible over the clearnet ("logfriend[.]com/login"), from where they can generate lures, set up campaigns, and manage captured tokens.

"Forg365 includes a deviceauth phishing branch that presents a Microsoftstyled verification code page and pushes the victim into a legitimate Microsoft Authentication Broker signin flow," ZeroBAC explained. "The victim sees real Microsoft authentication surfaces, but the code authorizes an attackercontrolled session."

For AitM phishing, the platform employs route tokens, session cookies, and traffic classification to determine whether to serve phishing content or a benign decoy. If a VPN connection is detected, the kit redirects to innocuous decoy content instead of exposing the phishing pages.

A notable aspect of the Forg365 platform is that it offers an extension named ForgCookie for Chromiumbased browsers like Google Chrome, Microsoft Edge, and Brave that is designed for continued access to the compromised accounts. Described as an "automatic SSO cookie refresh for Microsoft services," the addon acts as an intermediary between the token acquisition and browser access by cycling through the steps listed below

Requests account data from the Forg365 backend

Calls the cookiegeneration endpoint for a selected account

Clears Microsoft session cookies

Injects the generated refreshtoken credential cookie into the Microsoft login domain

Triggers a silent OAuth flow

Captures resulting Microsoft cookies across Microsoft domains

Forg365's extends beyond simple credential and token harvesting to facilitate a wide array of postcompromise actions, including monitoring for specific keywords in compromised email accounts and drafting a message response to a particular email thread using assistance from AI.

"The result is a platform that lowers the skill threshold while increasing operational consistency. Less experienced affiliates can use prebuilt templates, while more capable operators can customize landing pages, rotate infrastructure, manage tokens, generate cookie material, and monitor compromised accounts," ZeroBAC said.

The disclosure coincides with the discovery of various campaigns that have been found to employ phishing kits for credential theft

Sending fake Microsoft account activity alerts from a legitimatebutcompromised thirdparty SaaS sender account to direct users to Sneaky 2FAstyle phishing pages to launch a redirection chain that leads to the final phishing host, but not before performing checks to decide whether the visitor is a real user.

Using phishing emails that direct recipients to a website hosted on Canva, which then triggers the device code phishing flow to hijack Microsoft accounts using the Kali65 phishing kit. The kit supports over 33 different lures, a payout pipeline, and a desktop application called OctoLink Live (aka Kali365 Live) that abuses the stolen token to launch a Chromium browser session and open the victim's mailbox in OWA, OneDrive, SharePoint, or admin.microsoft.com. The platform also offers a tool known as OctoLink Sender to masssend phishing emails from the breached account to other contacts, a technique called lateral phishing.

Phishing campaigns using Kali365 have also distributed phishing pages impersonating Russia's MAX messenger, indicating an attempt to single out users in Russia. "A phishing operator who can convert MAX account takeovers into propagation has access to one of the largest installed messaging bases in the Russianspeaking world," Arctic Wolf said.

Sending emails mimicking the IRS and Social Security Administration, alongside Adobe, Microsoft, DocuSign, and Dropbox, to deliver legitimate remote access software like ConnectWise ScreenConnect as part of phishing campaigns using a PhaaS kit called The Quarry that's developed, maintained, and sold by a lone operator named RockyBelling. The price of the kit ranges anywhere between $500 and $3,000. This includes tools like Rocky Gmail Sender (a bulk email tool), Rocky Email Sorter (to sort email addresses by domain across Gmail, Yahoo, Hotmail, and AOL), and VioletRAT.

Sending SMS messages impersonating the U.S. Postal Service (USPS) and UPS to trick victims into visiting a phishing page that prompts users to enter their personal and financial information under the pretext of a failed package delivery and scheduling a new delivery. "Underneath the deception, the kit captures data in real time," Censys said. "It opens a WebSocket back to its origin and streams the victim’s card data keystrokebykeystroke, runs a serverside BIN lookup on the card number, and pushes routing decisions (retry, PIN prompt, OTP prompt, killswitch) back into the victim's browser while they type."

Using fake bid proposal workflows to take over Google accounts using a framework called Nyasher. The redirection chain incorporates a "pressandhold" verification page to filter out automated scanners and bots, before navigating to a blob URL. "The final page displayed a Google signin interface but was not reachable as a normal hosted HTML document," ZeroBAC said. "It existed as a browsercreated object URL."

Using bogus Google Partners and Google Premier Partner enrollment workflows in phishing emails to redirect recipients to a fake Google signin page designed to capture credentials in real time as part of a campaign codenamed GPPStorm.

Using a legacy email alias to target a user's inbox and launch a device code phishing flow that uses the EvilTokens kit. "The kit was reached through a Mailjet tracking link, then a compromised WordPress site, then a CAPTCHA interstitial, then the Cloudflare Workers host," ZeroBAC said. "Three live infrastructure hops between the email body and the kit, none of which is the kit itself."

To counter these threats, it's recommended to block device code authentication unless it's required, review mailbox artifacts after device code events for any signs of unusual activity, audit mailflow rules, and decommission legacy aliases that no longer correspond to active employees.

"The campaign succeeded in reaching the inbox because the recipient organization still maintained an active forwarding relationship from a preacquisition namespace into a current mailbox," ZeroBAC noted.

"The attacker used a stillresolvable historical identity to deliver mail that, from the SEG's point of view, looked like normal forwarded correspondence. From the user's point of view, the message landed in their working inbox with no visible cue that it had taken an indirect path."