Executive Summary
Forg365, a $400/month phishing service, combines device code phishing, AitM session theft, antibot evasion and AI-assisted lure creation against Microsoft 365.
What Happened
A new phishing-as-a-service (PhaaS) operation called Forg365 is using a combination of device code phishing, adversary-in-the-middle (AitM) tactics, antibot evasion, artificial intelligence (AI)-assisted lure creation, and post-compromise mailbox operations targeting Microsoft 365 accounts. Distributed via Telegram and costing $400 a month (or $3,800 per year), attack chains leverage phishing
Affected Products
- Microsoft 365
Vulnerability / Attack Technique
Phishing-as-a-service with AI-written lures
Technical Mechanism
AI generates lure content.
AI Security Category
AI-assisted attack
Part of the AI-Assisted Attacks topic.
RealGround Analysis
AI is now a standard phishing kit feature.
Recommended Controls
- Restrict device code flow
- Use phishing-resistant MFA
Related RealGround Service
AI CISO Advisory · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/07/forg365-phaas-targets-microsoft-365.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.