For $400 a month, criminals get a full dashboard for hijacking Microsoft 365 accounts, including a browser add-on that quietly renews stolen access every time it starts expiring.

 

What happened

A phishing-as-a-service platform called Forg365 has emerged, offering an unusually complete set of tools for taking over Microsoft 365 accounts, sold openly on Telegram for $400 a month or $3,800 a year. According to BleepingComputer, the platform supports two main attack methods. The first, device code phishing, shows a victim a page styled to look like a Microsoft verification screen and walks them through a genuine Microsoft sign-in process using a code the attacker generated in advance, meaning the attacker never needs to steal the victim's password directly. The second, adversary-in-the-middle phishing, places a fake page between the victim and Microsoft's real login system, capturing session information, authentication tokens, and browser cookies once the victim successfully signs in. Researchers found the platform includes a built-in tool for generating convincing phishing emails and lures, letting buyers create realistic invoices, voicemail notifications, or password reset messages without needing any outside AI tool of their own.

 

Going deeper

What sets Forg365 apart from many earlier device code phishing kits is what happens after the initial theft. According to The Hacker News, the platform's control panel offers a feature called Token Vault for storing captured authentication tokens, along with account intelligence tools that let attackers search a compromised mailbox and set up keyword alerts that notify them whenever specific terms appear in a victim's emails. A browser extension called ForgCookie, built to work with Chrome, Edge, and Brave, automatically refreshes the Microsoft single sign-on cookies tied to a stolen account, keeping the attacker's access alive well past the point it would normally expire. The platform sends its phishing emails using legitimate services, including Amazon's email delivery system and a widely used marketing email platform, which helps the messages blend into normal email traffic rather than standing out as obviously suspicious. To avoid being caught by security researchers, the platform also checks whether incoming traffic is coming from a VPN connection, and if it is, quietly redirects that visitor to a harmless decoy page instead of showing them anything malicious.

 

What was said

Researchers stated in findings cited by The Hacker News that "the panel exposes a mature operator workflow: accounts, links, invitations, OAuth app configuration, redirect links, SVG generation, campaign sending, SMTP profiles, SMTP rotation, AI email generation, token vaulting, account intelligence, keyword alerts, viewer links, and browser-extension support." Researchers also confirmed that the platform's device code feature "presents a Microsoft-styled verification code page and pushes the victim into a legitimate Microsoft Authentication Broker sign-in flow," meaning the victim genuinely sees real Microsoft screens throughout, while the code they enter actually authorizes the attacker's own session rather than their own device.

 

In the know

Forg365 has entered a marketplace that has grown considerably crowded in a short period of time. According to BleepingComputer, researchers now track at least six other platforms using the same core device code technique, including EvilTokens, Kali365, Tycoon2FA, Venom, and a separate emerging tool called Jalisco. Researchers recommended that organizations reduce Microsoft Entra's default limit on how many devices a single account can register from 50 down to just one or two, which would also make it faster to contain and clean up an account after a suspected compromise.

 

The big picture

Healthcare organizations deciding whether device code phishing is worth prioritizing over other security investments should weigh what a persistence tool like ForgCookie actually means in practice. Standard advice after a suspected account compromise, changing the password and requiring a new multi-factor sign-in, does nothing to stop an attacker whose stolen session is being automatically refreshed in the background by a purpose-built browser extension. According to Paubox's 2026 Healthcare Email Security Report, 53% of breached healthcare organizations in 2025 used Microsoft 365, and a compromised account with this level of persistence built in can continue exposing patient scheduling data, billing communications, and clinical correspondence for far longer than a typical incident response timeline assumes.

 

FAQs

Why doesn't resetting a password remove an attacker's access after this kind of compromise?

The attacker in a device code or adversary-in-the-middle attack never actually needs the victim's password to begin with. They hold a valid authentication token or session cookie that Microsoft's own systems issued directly to them. Changing the account password does not automatically revoke that token, meaning the attacker can keep working with the same stolen access even after the victim believes they have secured their account.

 

What does the ForgCookie browser extension actually do?

It is a tool the attacker installs, not something that ends up on the victim's device. It works behind the scenes to periodically request fresh account data from the Forg365 platform, clear out the old session cookies it is holding, and quietly trigger a new sign-in flow to capture updated cookies before the old ones expire, effectively giving the attacker continuous access to a compromised Microsoft account without needing to phish the victim again.

 

Why does using legitimate email delivery services like Amazon SES help these phishing emails avoid detection?

Email security tools assess the reputation of the infrastructure through which the message was actually sent. Messages sent using a legitimate, widely trusted bulk email delivery service carry a better reputation than those sent from an obviously suspicious or newly registered mail server, making it more likely the phishing email passes filtering and lands in the inbox rather than being blocked or flagged.

 

Why does the platform redirect VPN traffic to a harmless decoy page?

Security researchers and automated scanning tools frequently use VPN connections to investigate suspicious links safely, without exposing their real location or identity. By detecting VPN traffic and quietly showing something harmless instead of the actual phishing content, the platform reduces the chance that its infrastructure gets discovered, analyzed, and blocked before it can be used against a real victim.

 

What organizational setting most directly limits the damage a stolen account can cause under this kind of persistent access?

Reducing how many devices a single account is allowed to register through Microsoft Entra, combined with promptly and completely revoking all active sessions and tokens the moment a compromise is suspected, rather than only resetting the password, removes the specific mechanism tools like ForgCookie depend on to maintain long-term access.