Forg365 Sells Microsoft 365 Takeovers for $400 a Month via Telegram
Updated
Updated · CSO Online · Jul 14
Forg365 Sells Microsoft 365 Takeovers for $400 a Month via Telegram
3 articles · Updated · CSO Online · Jul 14
Summary
$400-a-month Forg365 packages AI-built phishing lures, device-code abuse and adversary-in-the-middle flows into a Telegram-sold service that lets less-skilled attackers hijack Microsoft 365 accounts.
ZeroBEC said the platform classifies visitors, routes them through legitimate Microsoft authentication when useful, and diverts suspicious traffic to benign pages to evade researchers and automated defenses.
ForgCookie then lets attackers generate and refresh Microsoft single sign-on cookies, while mailbox monitoring, forwarding changes and shared read-only access can keep intruders inside even after a password reset.
Defenders were urged to restrict device-code authentication in Microsoft Entra ID where possible, deploy phishing-resistant MFA such as FIDO2 or passkeys, and revoke refresh tokens, sessions, OAuth grants and unauthorized devices after a breach.
The service's significance, researchers said, is the productization of the full phishing workflow—from lure creation to post-compromise mailbox operations—further industrializing Microsoft 365 account takeovers.
As phishing becomes a subscription service, is any company using Microsoft 365 truly prepared for what's next?
When AI writes flawless phishing emails, how can anyone be expected to spot the next sophisticated scam?
Forg365 Exposed: The Next Generation of Phishing-as-a-Service and the Escalating Threat to Microsoft 365
Overview
Forg365 is a new Phishing-as-a-Service (PhaaS) platform that emerged in mid-2026, marking a major shift in cybercrime. It stands out by deeply integrating artificial intelligence and automation, making advanced phishing attacks easier for even low-skilled threat actors. Forg365’s subscription model and distribution through channels like Telegram lower the entry barrier for cybercriminals. Its AI-powered features allow users to launch convincing phishing campaigns with minimal effort, especially targeting Microsoft 365 accounts. This evolution shows how phishing is becoming more industrialized and accessible, raising the risk and impact of attacks for organizations and individuals alike.