The gist: Forg365 democratizes phishing attacks on Microsoft 365 through an AI-powered service model that combines AiTM techniques with automated lure generation.
A new phishing service called Forg365 systematically targets Microsoft 365 accounts, combining Adversary-in-the-Middle attacks with device code procedures and AI-generated phishing material. This infrastructure is marketed as a service model, thereby significantly lowering the technical entry barrier for attackers.
Security researchers have identified a new Phishing-as-a-Service (PhaaS) platform named Forg365 that specifically targets Microsoft 365 user credentials. The system combines multiple established attack methods: Adversary-in-the-Middle attacks (AiTM), in which attackers position themselves between user and server, as well as the device code procedure, which builds on OAuth authentication.
A key distinguishing feature is the integration of AI-powered lure generation. The platform uses artificial intelligence to generate phishing baits and social engineering messages that are specifically tailored to Microsoft 365 environments. This enables less trained attackers to conduct more convincing and targeted phishing campaigns without having to develop their own text or scenario content.
For CISOs, this represents an increased threat to enterprises with Microsoft 365 deployments. The combination of technically sophisticated attack procedures with low barriers to entry and AI support increases both the likelihood and success rate of targeted phishing campaigns. Particularly critical: compromised Microsoft 365 accounts give attackers immediate access to email, cloud storage, and integrated enterprise tools.
Recommended countermeasures include strengthening multi-factor authentication, implementing Conditional Access, regular user training on phishing detection, and monitoring suspicious login attempts and unusual access patterns on Microsoft 365 accounts.
Source: www.bleepingcomputer.com · Published July 9, 2026
Lumi AI News — AI-assisted curation in accordance with Article 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.3.