Loading malware…
4 distinct techniques documented for this family, organized by ATT&CK tactic.
Their investigation began by analyzing phishing emails that posed as business documents, carefully crafted to mimic a trusted service.
A notable aspect of the Forg365 platform is that it offers an extension named ForgCookie for Chromium-based browsers... designed for continued access to the compromised accounts... Captures resulting Microsoft cookies across Microsoft domains.
For AiTM phishing, the platform uses a proxy for the authentication requests and data exchanged between the Microsoft infrastructure and the target account, capturing session cookies in the process.
A browser extension called ForgCookie reportedly automatically refreshes Microsoft single sign-on cookies, helping criminals retain browser-based access after the victim has authenticated.
For AiTM phishing, the platform uses a proxy for the authentication requests and data exchanged between the Microsoft infrastructure and the target account, capturing session cookies in the process.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.