Forg365 Makes M365 Takeovers “Phishing for Dummies”

How the attack worked

The campaign began with an email built around a business-document and remittance-approval pretext, a theme designed to create urgency for finance and accounts payable staff. The message relied on legitimate cloud and email services before routing recipients through several redirects, eventually reaching either a device-code phishing page or an adversary-in-the-middle flow. Forg365, the underlying phishing-as-a-service platform, classified visitors before deciding which page to show, and suspicious visitors were diverted to a benign decoy page to help conceal the phishing flow from researchers and automated security tools.

In the device-code variant, the victim is directed to a legitimate Microsoft authentication process and persuaded to enter a code that authorizes a session controlled by the attacker. Because the flow uses genuine Microsoft infrastructure, the request can appear credible even to attentive users. A companion browser extension, described in the reporting as ForgCookie, helps attackers generate or refresh Microsoft SSO cookies, which means access can persist after a password reset.

Why it succeeded

Several factors made this approach effective:

• The service includes templates that impersonate widely used business platforms such as DocuSign, Adobe Acrobat Sign, SharePoint, and OneDrive, making the lure familiar to knowledge workers.
• The device-code method borrows real Microsoft sign-in infrastructure, so victims are not asked to enter credentials on an obviously fake site.
• Decoy pages and visitor classification helped operators avoid detection by researchers and security tooling.
• The cookie-refresh capability meant that a password reset alone did not remove attacker access.

What to watch for

Defenders and employees should treat the following as red flags:

• Unexpected remittance or document-approval requests that create urgency to act quickly.
• Multiple redirects before landing on a Microsoft sign-in page.
• Any request to enter a device code to “approve” a document, which is unusual for normal workflows.
• Repeated or unexplained sign-ins shortly after interacting with a suspicious message.

Building resistance

Organizations can reduce risk with a mix of awareness and technical response steps. Staff should be trained to treat unexpected document or signature emails as high-risk and verify requests through a known channel before clicking, and to stop and report any prompt asking them to enter a Microsoft device code. On the response side, security teams should revoke active refresh tokens and terminate existing sessions after a suspected compromise, review OAuth permissions, and audit mailbox forwarding rules, delegated access, and newly registered devices, since these changes could let attackers monitor communications or retain access after remediation.

What is Forg365?

Forg365 is a phishing-as-a-service platform distributed via Telegram that lowers the technical skill required to compromise Microsoft 365 accounts using convincing document-themed lures.

How does the device-code phishing attack work?

A victim is directed to a legitimate Microsoft authentication process and persuaded to enter a device code, which authorizes a session that is actually controlled by the attacker.

Does resetting a password stop a Forg365 attacker?

Not necessarily. A companion browser extension can generate or refresh Microsoft SSO cookies, so access can persist even after a password reset unless refresh tokens are revoked and sessions terminated.

What should security teams check after a suspected compromise?

Teams should revoke active refresh tokens, terminate existing sessions, review OAuth permissions, and audit mailbox forwarding rules, delegated access, and newly registered devices.