New Forg365 phishing platform uses AI to target Microsoft 365 accounts
New Forg365 phishing platform uses AI to steal Microsoft 365 accounts via AiTM and device code methods.
A new phishing-as-a-service (PhaaS) operation named Forg365 is targeting Microsoft 365 accounts by employing adversary-in-the-middle (AiTM) and device code phishing techniques. The platform leverages AI for generating phishing lures and includes a browser extension for persistent access to compromised accounts. Researchers note the integration of AI reduces development costs for both phishing content and PhaaS platforms.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Forg365 platform represents a significant evolution in phishing threats by combining AI-generated lures with adversary-in-the-middle (AiTM) and device code phishing techniques, enabling attackers to bypass traditional multi-factor authentication. By automating phishing content creation with AI, the barrier to entry for cybercriminals has dropped dramatically, making sophisticated attacks more scalable and harder to detect. The inclusion of a malicious browser extension further enables persistent access even after password resets, extending the attacker's foothold. This matters because Microsoft 365 accounts are a high-value target holding sensitive business data, email communications, and access to interconnected cloud services — compromise of one account can cascade across an entire organization.
What helps against this
How we list vendors
- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.