Executive Summary
Forg365 is a sophisticated Phishing-as-a-Service (PhaaS) platform specifically designed to compromise Microsoft 365 and Entra ID environments. The platform employs Adversary-in-the-Middle (AiTM) and device-code phishing techniques, allowing attackers to bypass standard multi-factor authentication (MFA) and capture active session tokens. Observed campaigns use fake quarantine notifications to lure victims through complex redirect chains that include visitor fingerprinting to evade security researchers.
Technical analysis reveals that Forg365 uses conditional delivery to serve different content based on the visitor's environment, often hiding behind CAPTCHAs and client-side checks to distinguish between real targets and automated scanners. The primary business risk involves successful session hijacking, which enables follow-on activities such as business email compromise (BEC), internal phishing, and unauthorized access to sensitive financial and corporate communications.
Organizations in the technology, manufacturing, and financial sectors are currently seeing the highest volume of activity. Security leaders are urged to prioritize the transition to phishing-resistant MFA (FIDO2) and restrict unnecessary device-code authentication flows to mitigate these specific attack vectors.