AI-powered phishing platform Forg365 targets Microsoft 365 accounts
A new phishing platform has emerged, combining advanced techniques with AI to trick users into surrendering their Microsoft 365 credentials. Dubbed Forg365, the service operates as a phishing-as-a-service (PhaaS) model, allowing cybercriminals to lease sophisticated attack infrastructure without needing deep technical expertise.
How it blends two attack methods
Forg365 leverages a dual approach: adversary-in-the-middle (AiTM) phishing and the device code OAuth flow. AiTM intercepts login sessions, capturing credentials and session tokens in real time, while the device code method tricks users into approving a sign-in request on a rogue device. Together, these methods create a high-success-rate attack chain that bypasses traditional multi-factor authentication (MFA) defenses.
AI-generated lures to fool even vigilant users
What sets Forg365 apart is its use of AI to generate personalized phishing messages. Instead of generic emails, the platform crafts contextually relevant lures—such as fake HR notifications, IT alerts, or finance reports—that mimic legitimate communication. This reduces suspicion and increases the likelihood of a user clicking a malicious link or approving a fraudulent device code prompt.
Why it matters
Forg365 illustrates how AI is lowering the barrier to entry for cybercrime, enabling less-skilled threat actors to launch highly effective attacks. For organizations relying on Microsoft 365, this means phishing risks are no longer limited to sophisticated groups. Enhanced monitoring for anomalous OAuth flows, user education on recognizing AI-generated content, and strict access policies remain critical defenses. The rise of AI-powered phishing platforms signals a shift toward more adaptive and personalized threats—requiring a proactive, layered security strategy.
Source: BleepingComputer. AI-assisted editorial synthesis — TechnoExpress.