Forg365 Phishing Platform Leverages AI for Microsoft 365 Attacks

A novel phishing-as-a-service (PhaaS) operation named Forg365 has emerged, specifically targeting Microsoft 365 accounts. This platform combines sophisticated attack methods, including adversary-in-the-middle (AiTM) and device code techniques, with artificial intelligence to enhance its phishing campaigns. The AI component is used to generate more convincing and personalized lures, increasing the likelihood of successful credential theft.

Forg365's operational model as a PhaaS means it provides the infrastructure and tools for other malicious actors to conduct phishing attacks, rather than conducting attacks itself. This lowers the barrier to entry for cybercriminals. The platform's focus on Microsoft 365 is significant, given the widespread use of this productivity suite by businesses globally, making it a high-value target for attackers seeking access to sensitive corporate data and systems.

The AiTM technique employed by Forg365 allows attackers to intercept communications between a victim and a legitimate service, such as Microsoft 365. This enables them to steal session cookies, bypassing multi-factor authentication (MFA) in some instances. The integration of AI in lure generation suggests a move towards more dynamic and adaptive phishing strategies, which can be harder for traditional security defenses to detect and block. Security researchers are actively monitoring Forg365's activities and its potential impact on Microsoft 365 users.