Forg365: A Phishing Service That Hides From Scanners and Keeps Stolen Microsoft 365 Sessions Alive

Forg365 is a subscription kit that shows scanners a decoy page, steals Microsoft 365 sessions through a device-code or proxy sign-in branch, and keeps them alive with a browser extension.

It arrives as ordinary email. ANY.RUN reproduced the chain from a fake quarantine notice, and The Hacker News reports business-document and remittance-approval lures sent through Amazon SES. What follows depends on who opens the link. A scanner or a VPN connection is sent to a harmless page; an employee is sent to a Microsoft sign-in flow that ends with the attacker holding the account.

How does Forg365 take over a Microsoft 365 account?

A quarantine notice starts the chain

ANY.RUN's sandbox session begins with a fake quarantine notification. The link sends the victim through a redirect chain that carries the victim's email address as a URL parameter, so the kit knows whose session it is after. The Hacker News reports that observed campaigns used business-document or remittance-approval lures.

The sender domain uses Amazon SES for delivery, and the message body contains SendGrid-hosted images or tracking resources, according to The Hacker News. Both are legitimate and widely used services, so the message looks like ordinary software-as-a-service mail.

A visitor check decides what each person sees

Before any credential page, ANY.RUN observed a fake CAPTCHA and client-side checks. The observed logic can distinguish VPN traffic, bots and research environments from other visitors. For the AiTM branch, The Hacker News reports that the platform uses route tokens, session cookies and traffic classification to decide between phishing content and a benign decoy.

ANY.RUN states the consequence directly: "a suspicious URL can look inactive in one environment and malicious in another". A report from a scanner or an analyst can therefore describe a different page from the one an employee was shown.

Two branches end in the same place

In the device-code branch, researchers quoted by The Hacker News describe a Microsoft-styled verification code page that moves the victim into the genuine Microsoft Authentication Broker sign-in. The employee sees real Microsoft pages while authorizing a session the attacker holds.

ANY.RUN's run reached the AiTM branch, after the fake CAPTCHA, at a fake Microsoft identity verification page. ANY.RUN says the platform also supports device-code phishing, but that path was not executed in its analysis.

What does the operator get after the first sign-in?

ForgCookie keeps the session alive

The Hacker News describes ForgCookie as an extension for Chromium-based browsers such as Chrome, Edge and Brave, built for continued access to compromised accounts. Its cycle, as reported, is to request account data from the Forg365 backend, call a cookie-generation endpoint for a selected account, clear the Microsoft session cookies, inject the generated refresh-token credential cookie into the Microsoft login domain, trigger a silent OAuth flow and capture the resulting Microsoft cookies.

ANY.RUN adds the defender's side. A compromised mailbox can become a base for business email compromise, fraud and internal phishing, and a password reset alone should not be the only containment action.

The panel adds mailbox tools

The Hacker News reports that the kit goes beyond credential and token harvesting. It can watch compromised mailboxes for chosen keywords and use AI to draft a reply to a specific email thread. The panel is reached over the clearnet at logfriend[.]com/login, per the same report. Customers use it to generate lures, set up campaigns and manage captured tokens.

What does a subscription kit change for defenders?

Priced and supported like software

The Hacker News reports a security vendor's view that the kit is best understood as similar to the Kali365 and Sneaky 2FA ecosystems, and calls the model industrialized: lure creation, delivery, evasion, token handling and mailbox operations under one subscription, open to attackers with little technical skill. The report does not say the operators are linked to those kits.

Who is seen with it

ANY.RUN reports industry risk signals of 56 percent for technology, 31 for manufacturing, 19 for consulting and 18 for banking, and says the data does not support a single-sector campaign. Of Forg365-related submissions, 51 percent come from the United States, followed by the United Kingdom at 6, Australia at 5 and Mexico at 2. ANY.RUN adds that these figures show where activity is observed in its data, not deliberate targeting.

How can organisations protect Microsoft 365 from device code phishing?

ANY.RUN names four priorities. They map onto the kit's two branches and its persistence step.

A passkey proves the user to the real Microsoft page, and the device-code branch uses that real page, so the block is the control that fits that branch. This is AegisAI's reading, not a statement from either source.

Why standard controls miss it

A gateway that scans a link sees whatever the visitor check chooses to show a scanner. ANY.RUN's analysis found checks that separate VPN traffic, bots and research environments from other visitors, and The Hacker News reports a decoy for VPN traffic, so a clean verdict at scan time says little about what the employee saw.

The device-code branch removes the usual tell. The final page is genuine Microsoft infrastructure, so an employee trained to check the address bar finds nothing wrong, and a reputation check on the destination finds a real Microsoft domain. The abuse is in what the code authorizes. After sign-in, a control that watches passwords or waits for a new login from an unfamiliar place has little to react to when the attacker replays a session the extension keeps refreshing (AegisAI's own reading of the reported ForgCookie cycle).

How AegisAI protects against it

This is AegisAI's own reading, framed for email delivery because ANY.RUN and The Hacker News both describe the lure as an email. The reporting does not say how every campaign is delivered.

Aegis does not classify infrastructure. It classifies intent. A lure with no attacker-owned infrastructure still has to ask the recipient to do something on the attacker's behalf, and that request is what gets classified, independent of how clean the destination URL is.

AegisAI's agents evaluate the message and the destination it points to together, and pull a malicious message out of mailboxes before users see or click it. More on how that works: inbound email security.

When a lure or a compromised session is caught, the response compounds: the message is withheld at classification, copies already delivered are retracted, rewritten links refuse a late visit, the account's outbound and internal mail gets rescanned, and lateral phishing attempts to colleagues are blocked at the same bar rather than treated as a fresh, unrelated message.

What the reporting does not tell us

Victim counts. No source gives the number of organisations or accounts compromised. ANY.RUN's figures describe its own submissions, not victims, and ANY.RUN says they do not prove targeting.

Few indicators. ANY.RUN's page lists one domain with a page path, two further domains and a handful of request patterns that look specific to the kit. The rest of its indicator list is mostly ordinary Microsoft, Cloudflare and other service endpoints seen in the sandbox, with no label saying which are malicious, so they are left out. The Hacker News gives one more host, the operator panel. No source here publishes sign-in log markers or a full infrastructure list.

Lure wording. ANY.RUN shows a quarantine notice and The Hacker News names business-document and remittance-approval themes. Neither gives a subject line list, a send volume or the share of campaigns that use each theme.

Branch mix. ANY.RUN's own run reached only the AiTM branch. No source says how often real campaigns use each branch.

Ageing. The domains below were seen on specific dates. ANY.RUN says route values and infrastructure change, so the behaviour is the better hunting signal.

Indicators published on the ANY.RUN page

These come from ANY.RUN's analysis page. They are written with [.] so they cannot be clicked, and are best used as historical context and hunting leads, not a live blocklist.

MITRE ATT&CK mapping

This mapping is AegisAI's own reading of the reported behaviour. Neither source publishes a technique table, and ANY.RUN's page lists none.

Recommendations for defenders

FAQ

References