The cybersecurity landscape is facing a growing threat with the emergence of increasingly sophisticated phishing-as-a-service (PhaaS) services. Recently, an operation called Forg365 has attracted attention, which combines advanced techniques such as phishing using device codes, adversary-in-the-middle (AitM) tactics, evasion of anti-bot systems, use of artificial intelligence to create custom decoys, and post-compromise operations on Microsoft 365 mailboxes. This type of attack, distributed through Telegram at a cost of $400 per month or $3,800 per year, represents a qualitative leap in the professionalization of cybercrime. In this article, we will take an in-depth look at how this threat works, why it is particularly dangerous for businesses, and what protective measures can be taken, highlighting the role of technological solutions such as those offered by Q2BSTUDIO.
Device code phishing is a relatively new technique that exploits the OAuth 2.0 authentication flow for devices without a full browser, such as smart TVs or consoles. In this attack, the cybercriminal requests a device code from Microsoft to sign in. Then, using a fake website that mimics the Microsoft 365 login page, it tricks the victim into entering that code. By doing so, the attacker obtains an access token and can hijack the session without stealing the password. The AitM tactic, on the other hand, allows the attacker to intercept and modify traffic between the victim and the legitimate service, even evading multi-factor authentication (MFA) by presenting a fake login page that captures credentials and verification codes.
What makes Forg365 especially dangerous is the integration of artificial intelligence to generate convincing lures. AI allows phishing messages to be personalized based on the information available about the target, increasing the likelihood that the user will fall for the deception. In addition, the service includes bot evasion mechanisms that make it difficult for automated security systems to detect. Once the account is compromised, attackers perform operations on the mailbox, such as searching for sensitive information, sending internal emails to spread the threat, or setting up forwarding rules to maintain persistent access.
For companies using Microsoft 365, this type of attack poses a critical risk. Corporate email houses sensitive data, internal conversations, and access to other systems. A compromise can lead to leaks, financial fraud or reputational damage. The sophistication of Forg365 demonstrates that traditional defenses, such as simple SMS-based MFA or authenticator applications, are not enough if the attacker manages to intercept the session using AitM. Therefore, it is necessary to adopt a multi-layered security approach that combines technology, processes, and training.
Recommended protection measures include implementing Conditional Access policies in Azure AD, which allow you to block sign-ins from untrusted locations or devices. It's also crucial to use phishing-resistant MFA, such as FIDO2 security keys or passwordless authentication using Windows Hello or the Microsoft Authenticator app with number detection. Additionally, businesses should monitor login events for anomalies, such as the use of device codes from suspicious IP addresses. Continuous training of employees to identify phishing attempts, especially those generated by AI, remains one of the most effective defenses.
In this context, having a specialized technology partner like Q2BSTUDIO can make all the difference. Q2BSTUDIO offers cybersecurity and pentesting services that help identify vulnerabilities in Microsoft 365 infrastructure and implement robust controls. Through security audits and penetration tests, it is possible to detect weak points before they are exploited. In addition, the company develops custom applications and custom software to integrate customized security solutions, tailored to the specific needs of each organization.
Artificial intelligence also plays a dual role in this fight: while attackers use it to create decoys, defenses can employ it to detect anomalous patterns. Q2BSTUDIO offers artificial intelligence and AI services for companies that allow training models capable of identifying suspicious behavior in real time, such as logins from unusual devices or AitM traffic. These AI agents can act as security assistants, automating incident responses and reducing reaction time. In addition, integration with AWS and Azure cloud services allows these solutions to be deployed in scalable and secure environments.
Another layer of defense is business intelligence applied to cybersecurity. With tools like Power BI, it's possible to visualize dashboards that consolidate authentication logs, phishing events, and security alerts, making it easier to make informed decisions. Q2BSTUDIO offers business intelligence and Power BI services to transform security data into actionable insights. In addition, companies can benefit from process automation to orchestrate incident responses, such as automatically locking compromised accounts or revoking tokens.
In short, the emergence of operations like Forg365 underscores the constant evolution of cyber threats. The combination of phishing with device codes, AitM, bot evasion, and generative AI requires companies to strengthen their security strategies holistically. It is not enough to rely on generic solutions; A customized approach is necessary that takes into account the specific architecture of each organization. Collaborating with experts such as Q2BSTUDIO allows you to access a complete portfolio of services ranging from cybersecurity consulting to custom software development, including the implementation of artificial intelligence and the management of cloud infrastructures. Investing in protection is now more than ever a strategic priority for any company that relies on Microsoft 365.
