Forg365 Phishing Kit Steals Microsoft 365 Sessions

How the Forg365 attack chain works

Forg365 is a phishing-as-a-service kit sold via Telegram that targets Microsoft 365 accounts. It relies on business document-themed or remittance approval lures designed to get recipients, particularly in finance and accounts payable, to click malicious links. To avoid detection, the emails are sent through legitimate infrastructure such as Amazon SES, with SendGrid-hosted images or tracking resources embedded in the message body. The link chain eventually resolves to Forg365-controlled domains, but the early hops look like normal business traffic.

The device-code and session-theft angle

What makes Forg365 notable is a device-auth phishing branch. Instead of harvesting a password directly, it presents a Microsoft-styled verification code page and pushes the victim into a real Microsoft Authentication Broker sign-in flow. The victim sees genuine Microsoft authentication surfaces, but completing the flow authorizes a session for the attacker. A separate adversary-in-the-middle path uses stolen session cookies and traffic classification, including redirecting VPN users to benign decoy content to avoid tipping off defenders or automated scanners.

Why this approach succeeds

Several factors make this kit effective:

• Legitimate email delivery services make sender reputation checks less useful as a signal.
• Document and payment-approval pretexts create urgency without requiring obviously suspicious content.
• Device-code phishing exploits a legitimate Microsoft sign-in flow, so the authentication experience itself looks authentic.
• Post-compromise tooling can monitor mailbox keywords and draft AI-assisted replies inside existing email threads, extending the attack beyond initial access.

What to watch for

Employees, especially in finance, accounts payable, and executive support roles, should treat unexpected document or remittance approval requests as high-risk until verified through a separate channel. Red flags include:

• Being prompted to enter or approve a device code you did not initiate yourself.
• Authentication prompts appearing after clicking a link tied to a document or payment request.
• Externally hosted tracking images or links that pass through several redirects before landing on an unfamiliar domain.

Building resistance

Organizations can reduce exposure by blocking device code authentication unless it is genuinely required, reviewing mailbox artifacts after any device code sign-in event for unusual activity, and auditing mail-flow rules for unexpected changes. Pairing these controls with user training on device-code abuse and verification of payment or document requests through known channels can help limit the impact of kits like Forg365, which rely on blending real authentication experiences with attacker infrastructure.

What is Forg365?

Forg365 is a subscription phishing-as-a-service operation distributed via Telegram that targets Microsoft 365 accounts using document and remittance-themed lures.

How does the device-code phishing technique work?

Forg365 presents a Microsoft-styled verification code page that pushes victims into a legitimate Microsoft Authentication Broker sign-in flow, so the victim sees real Microsoft authentication surfaces while the code actually authorizes an attacker-controlled session.

Why do Forg365 emails avoid spam filters?

The kit uses legitimate email delivery infrastructure such as Amazon SES and SendGrid-hosted images and tracking resources, making the traffic look normal before it ultimately routes to Forg365-controlled domains.

What can organizations do to reduce risk from device-code phishing?

Recommended steps include blocking device code authentication unless required, reviewing mailbox artifacts after device code events, and auditing mail-flow rules for signs of unusual activity.