Forg365 PhaaS Targets Microsoft 365 with Device Code and AitM Session Theft

A phishing-as-a-service operation known as Forg365 is targeting Microsoft 365 accounts using various tactics. These tactics include device code phishing and adversary-in-the-middle techniques, as well as antibot evasion and artificial intelligence-assisted lure creation. The operation also involves post-compromise mailbox operations. Forg365 is distributed through Telegram and is available for a monthly fee of $400 or a yearly fee of $3,800. The service leverages phishing attack chains to compromise accounts.