Forg365 PhaaS Targets Microsoft 365 with Device Code and AitM Session Theft Forg365 PhaaS利用设备代码和AitM会话窃取针对Microsoft 365

TL;DR

• Forg365 is a sophisticated Phishing-as-a-Service (PhaaS) operation targeting Microsoft 365 accounts, utilizing device code phishing and Adversary-in-the-Middle (AitM) techniques to bypass traditional security controls.
• The platform integrates AI-assisted lure creation, legitimate email infrastructure (Amazon SES, SendGrid) for delivery, and advanced anti-bot evasion mechanisms to blend into normal traffic.
• Post-compromise capabilities include an automated browser extension (ForgCookie) for session persistence, keyword monitoring, and AI-generated email responses, lowering the barrier for non-technical attackers.
• Forg365 represents the industrialization of cybercrime, offering a subscription-based model ($400/month) that consolidates lure generation, delivery, token management, and lateral movement tools.

Why It Matters

This development highlights the rapid evolution of PhaaS platforms toward full automation and AI integration, significantly reducing the technical expertise required to conduct high-fidelity attacks against enterprise environments. The use of legitimate cloud infrastructure for both delivery and hosting makes detection increasingly difficult for traditional security tools, necessitating a shift toward behavioral analysis and identity-centric security models.

Technical Details

• Attack Vectors: Combines device code phishing (pushing victims to legitimate Microsoft Authentication Broker flows) and AitM proxies that intercept credentials and tokens.
• Evasion & Delivery: Utilizes Amazon SES and Twilio SendGrid for email distribution to mimic legitimate traffic, employs route tokens and traffic classification to detect and redirect VPN users to decoy pages, and includes SVG generation for visual fidelity.
• Session Persistence: Features the "ForgCookie" Chromium extension, which automates the refresh of Single Sign-On (SSO) cookies by clearing existing sessions, injecting refresh tokens, and triggering silent OAuth flows to maintain access.
• Post-Compromise Operations: Includes AI-assisted drafting of email responses, keyword alerting within compromised mailboxes, and tools for lateral phishing to spread the attack from breached accounts.

Industry Insight

Security teams must prioritize monitoring for anomalous OAuth consent grants and device code authentication patterns, as these are primary indicators of Forg365 activity. Organizations should implement strict conditional access policies that limit the use of legacy authentication and enforce multi-factor authentication requirements that are resistant to AitM proxies. Additionally, adopting email security solutions that can detect and block the misuse of legitimate SaaS providers like SendGrid for malicious campaigns is critical to disrupting the initial delivery phase.

TL;DR

• Forg365是一种针对Microsoft 365的成熟PhaaS服务，结合设备代码钓鱼、中间人攻击(AitM)及反机器人技术，月费400美元。
• 平台利用Amazon SES和SendGrid等合法基础设施分发诱饵邮件，并通过AI辅助生成钓鱼内容以降低攻击门槛。
• 提供名为ForgCookie的浏览器扩展，自动刷新SSO Cookie以维持对已攻破账户的长期访问权限。
• 支持后妥协操作，包括关键词监控和AI辅助邮件回复，并与Kali365、Sneaky 2FA等其他PhaaS生态形成工业化竞争态势。

为什么值得看

本文揭示了网络犯罪产业向高度自动化、低门槛化发展的最新趋势，展示了攻击者如何利用合法云服务基础设施和AI技术来规避检测并扩大影响。对于安全从业者而言，理解这种“全栈式”钓鱼服务的运作机制有助于优化针对Microsoft 365环境的检测规则和防御策略。

技术解析

• 混合攻击向量：Forg365结合了设备代码钓鱼（Device Code Phishing）和中间人攻击（AitM）。在AitM模式下，它通过路由令牌、会话Cookie和流量分类来决定是展示钓鱼页面还是良性诱饵，若检测到VPN连接则重定向至无害内容以规避分析。
• 合法基础设施滥用：攻击链利用Amazon SES发送邮件，并在邮件正文中嵌入由Twilio SendGrid托管的图片或跟踪资源，使钓鱼诱饵融入常规电子邮件流量中，难以被传统过滤器识别。
• 持久化访问机制：通过Chromium浏览器扩展“ForgCookie”，攻击者可以实现自动化的SSO Cookie刷新。该扩展从后端请求数据，清除现有Cookie，注入生成的刷新令牌，并触发静默OAuth流以捕获新的Microsoft域Cookie，确保持续访问。
• AI与后妥协操作：平台集成AI功能协助创建钓鱼诱饵和起草邮件回复，同时支持在攻破邮箱后监控特定关键词，实现了从初始入侵到横向移动和数据窃取的全流程自动化。

行业启示

• PhaaS工业化加剧：网络犯罪服务正迅速演变为类似合法SaaS的订阅模式，提供从诱饵生成、发送、逃避检测到后处理的一站式解决方案，极大降低了非技术背景攻击者的参与门槛。
• 合规云服务的风险：攻击者大规模滥用Amazon SES、SendGrid等合法云服务基础设施进行钓鱼分发，表明传统的基于信誉的邮件过滤机制面临严峻挑战，需加强对异常行为模式的检测。
• 防御策略需转向行为分析：鉴于Forg365等工具能够模拟合法的Microsoft认证流程和浏览器行为，仅依赖静态签名或域名黑名单已不足够，组织必须加强基于用户实体行为分析（UEBA）和多因素认证（MFA）的部署，特别是针对设备代码授权和Cookie劫持的监控。