Forg365 shows PhaaS became a $400/mo rental market

Forg365 is a $400-a-month subscription. That’s what The Hacker News reports on July 13 about a Microsoft 365 phishing kit that bundles device code phishing, adversary-in-the-middle session theft, antibot filtering, AI-assisted lure drafts, and a browser extension for holding stolen sessions open. Distribution runs through Telegram. Three thousand eight hundred dollars gets you the year.

The kit itself isn’t new in kind. Sneaky 2FA and the Kali365/Octopi365 line have offered comparable AitM tooling for months; EvilProxy and Modlishka walked the same road with earlier tools. What’s changed is finish. The researchers describe “a mature operator workflow: accounts, links, invitations, OAuth app configuration,” which is another way of saying the kit ships with the parts that used to require some understanding to assemble. Traffic classification decides whether to serve the phishing page or a benign decoy; VPN users get the benign version. A companion extension for Chromium browsers cycles cookie injection and silent OAuth across Microsoft domains to hold the session. Amazon SES and Twilio SendGrid carry the mail so the sender reputation does the work.

Post-compromise, the operator side is quieter and more disciplined than the kits from a decade back. Compromised mailboxes get scanned for keyword triggers and the reply is drafted with AI assistance. That’s not exploitation; that’s someone reading a customer’s invoice thread and answering it in-character to keep the fraud moving. It’s the same conversation that’s been happening inside BEC circles for years — only the transcript is faster and cheaper.

The mitigations aren’t new either. Disable device code authentication in tenants where no workload legitimately needs it; the disclosure’s own guidance leads with that step, and Microsoft’s Entra documentation has said the same for years. Audit mail-flow rules for silent forwards and hidden replies. Watch for post-device-code mailbox artifacts — inbox rules, delegated permissions, freshly granted OAuth consents — that appear in the minutes after a device code authorization. Decommission legacy email aliases nobody uses but attackers eventually find. None of that is exotic. It just doesn’t happen in most tenants because it’s tedious.

The point of PhaaS isn’t that any one kit is remarkable. The point is what the pricing tells you about the market. Four hundred dollars a month is a rounding error inside an operation that clears one successful invoice hijack, and the three Evilginx crews Lexfo pulled off an open server in Budapest were, by all appearances, paying comparable rent for a comparable toolchain. Cisco Talos’s writeup of ARToken and EvilTokens earlier this month made the same shape of argument about a different vendor. That price implies volume. Volume implies more of these tenants get hit next month than got hit last month, whether researchers name a specific campaign or not.

Same mistake, different decade. Device code was added to make legitimate cross-device sign-in less painful; every convenience that opts out of a browser eventually becomes something worth phishing. Turn it off where it isn’t doing work.