Forg365 PhaaS Targets Microsoft 365 with Device Code and AitM Session Theft

Forg365, a new PhaaS operation, is targeting Microsoft 365 accounts using a sophisticated combination of device code phishing, AitM tactics, and AI-assisted lure creation. The platform allows even inexperienced operators to orchestrate large-scale phishing campaigns with minimal technical expertise, leveraging infrastructure like Amazon SES and Twilio SendGrid. The operation utilizes various phishing kits, including Kali65 and The Quarry, to steal credentials and gain access to compromised accounts, often impersonating legitimate services like the IRS, Adobe, and even Russian messaging apps. Mitigation strategies include blocking device code authentication and reviewing mailbox artifacts for suspicious activity.