Forg365 attacks Microsoft 365: session theft and AI lures in PhaaS

Colleagues, here is a cybersecurity update: Forg365 PhaaS is targeting Microsoft 365 via device code phishing and AitM session theft.

Key points:
• operators distribute the kit on Telegram by subscription
• they use legitimate infrastructure and anti-bot checks for delivery
• the panel includes lure generation, token handling, and a ForgCookie module to extend access
• after compromise, the platform helps monitor mail and draft replies with AI

Why it matters: attacks are becoming easier for less experienced threat actors, while defense should focus on controlling device code auth, auditing mail-flow rules, and disabling legacy aliases.

How do you protect Microsoft 365 in such scenarios?
#cybersecurity #Microsoft365 #phishing #IdentitySecurity