As cited
Copy frozen at (site build).
threat intel
Forg365 PhaaS Targets Microsoft 365 with Device Code and AitM Session Theft
Forg365, a phishing-as-a-service operation, targets Microsoft 365 accounts using device code phishing, adversary-in-the-middle tactics, antibot evasion, and AI-generated lures distributed via Telegram. The service is available for $400 monthly or $3,800 annually and chains multiple compromise techniques.
Why it matters: Microsoft 365 administrators and security teams must monitor for device code phishing and AitM attacks, as this commercially available threat increases the likelihood that organizations will face these compromise techniques at scale.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Forg365 PhaaS Targets Microsoft 365 with Device Code and AitM Session Theft
No summary had been written when this copy was frozen.
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Forg365 PhaaS Targets Microsoft 365 with Device Code and AitM Session Theft
Researchers have identified a phishing‑as‑a‑service platform named Forg365 that targets Microsoft 365 accounts. The service combines device‑code phishing, adversary‑in‑the‑middle (AitM) techniques, antibot evasion, artificial intelligence (AI)‑generated lures, and post‑compromise mailbox actions. It is advertised on Telegram for $400 per month and provides attackers with a full chain to hijack corporate email.
Why it matters: Organizations relying on Microsoft 365 face credential and mailbox theft via device‑code and AitM phishing, so they should tighten conditional access and watch for unusual device‑code authentication attempts.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Forg365 PhaaS Targets Microsoft 365 with Device Code and AitM Session Theft
Researchers have identified a phishing‑as‑a‑service platform named Forg365 that targets Microsoft 365 accounts. The service combines device‑code phishing, adversary‑in‑the‑middle (AitM) techniques, antibot evasion, artificial intelligence (AI)‑generated lures, and post‑compromise mailbox actions. It is advertised on Telegram for $400 per month and provides attackers with a full chain to hijack corporate email.
Why it matters: Organizations relying on Microsoft 365 face credential and mailbox theft via device‑code and AitM phishing, so they should tighten conditional access and watch for unusual device‑code authentication attempts.
- Source published
- First seen by Cybersecurity Tracker