Forg365, a new phishing-as-a-service platform, is equipping cybercriminals with a comprehensive toolkit to hijack Microsoft 365 accounts. Sold via Telegram for $400 monthly, it automates every stage of an attack, from crafting AI-powered lures to exploiting post-breach access.
The platform's attack chain begins with highly personalized phishing emails generated by AI. Victims are duped into entering device codes, which grant attackers a valid session. To bypass security, Forg365 employs adversary-in-the-middle proxies that steal authentication tokens in real-time, rendering traditional MFA like push notifications useless.
Beyond initial compromise, Forg365 provides built-in tools for mailbox reconnaissance, internal phishing, and data exfiltration. This means attackers can monetize breaches immediately, emphasizing the need for robust post-breach monitoring.
The commoditization of such sophisticated techniques lowers the barrier for attackers. With antibot evasion and AI-driven scalability, Forg365 signals a shift toward more convincing and widespread phishing campaigns that evade standard training.
Security experts urge organizations to adopt phishing-resistant authentication, such as FIDO2 keys, to counter session hijacking. Additionally, monitoring for anomalous mailbox activities—like unusual rules or mass forwards—is crucial for early detection.
As cybercrime-as-a-service evolves, Forg365 exemplifies the threat. Defenders must prioritize both advanced authentication and behavior-based monitoring to mitigate risks.
Forg365，一個新興的網絡釣魚即服務（PhaaS）平台，正為網絡罪犯提供一套全面的工具包，用以劫持微軟365帳戶。該平台透過Telegram以每月400美元的價格銷售，能自動化執行攻擊的每個階段，從製作AI驅動的誘餌到利用入侵後的存取權限。
該平台的攻擊鏈始於由AI生成的極度個人化釣魚郵件。受害者被欺騙輸入裝置代碼，從而讓攻擊者獲得一個有效的會話。為繞過安全措施，Forg365採用中間人代理（adversary-in-the-middle proxies），即時竊取驗證token，使得如推送通知等傳統的多因素驗證（MFA）形同虛設。
除了初始入侵，Forg365還提供內建工具，用於郵箱偵察、內部網絡釣魚和資料外洩。這意味著攻擊者可以立即將入侵成果變現，凸顯了強健的入侵後監控的必要性。
此類複雜技術的商品化降低了攻擊者的門檻。憑藉反機器人規避和AI驅動的擴展能力，Forg365標誌著向更具說服力、更廣泛且能躲避標準安全培訓的網絡釣魚攻擊活動轉變。
安全專家敦促組織採用抗網絡釣魚的驗證方法，例如FIDO2金鑰，以對抗會話劫持。此外，監控郵箱的異常活動——例如不尋常的規則或大量轉發——對於早期偵測至關重要。
隨著網絡犯罪即服務的演變，Forg365堪稱威脅的典範。防禦者必須同時優先考慮先進的驗證和基於行為的監控，以降低風險。