Forg365 PhaaS Uses AI and Cookie Refreshing to Hijack Microsoft 365 Accounts

Researchers reported that Forg365, a phishing-as-a-service platform marketed through Telegram, is targeting Microsoft 365 and other Microsoft accounts with a mix of adversary-in-the-middle phishing, device-code phishing, session theft, and post-compromise mailbox access. The service includes an operator panel with AI-assisted lure generation, impersonation templates for Microsoft services, SMTP rotation, campaign scheduling, token storage, and mailbox keyword monitoring, giving attackers an end-to-end workflow for credential theft and account takeover.

Investigators said Forg365 can capture authentication tokens, browser cookies, and session data, while a companion browser extension, ForgCookie, refreshes Microsoft single sign-on cookies to preserve access without repeated reauthentication. Observed infrastructure included Amazon SES for email delivery, SendGrid-hosted resources, Cloudflare Pages landing pages, and Gophish components, alongside anti-analysis measures such as bot detection, debugger traps, sandbox checks, encrypted redirectors, and VPN-based benign redirection. Defenders were urged to restrict device-code authentication where possible, monitor Microsoft Entra logs, OAuth and Microsoft Graph activity, suspicious device registrations, and rapidly revoke sessions, refresh tokens, and OAuth access after suspected compromise.