A new phishing platform called

@wassimcti

30.8K followers · usually 19.2K views a post

Views

59.2K

Likes

3.7K

Comments

42

Shares

518

SoundTikTok sound · Galactic Portal

View velocity

+11.4K views over 33.5d · ~340/day · 6 observations

Promoted product

Forg365

Why it worked

The video effectively explains a sophisticated cyber threat in a concise and understandable manner, using clear visuals and a direct explanation of the attack mechanisms. The topic of cybersecurity threats, especially those targeting widely used platforms like Microsoft 365, is inherently engaging for a broad audience.

Summary

The video explains Forg365, a phishing-as-a-service platform that targets Microsoft 365 accounts. It uses two attack methods: a fake verification page and an adversary-in-the-middle approach to steal session cookies and maintain persistent access.

Structure

1Introduction to Forg365
2How it steals Microsoft 365 credentials
3Explanation of the two attack paths
4The Forge Cookie browser extension
5AI integration for refining attacks

Original caption

A new phishing kit called Forg365 steals your Microsoft 365 session and auto refreshes it so attackers keep access after you change your password. #cybersecurity #phishing #microsoft365 #infosec #AI

More from @wassimcti

Product placement

Forg365: (a) it ACTS - it is a phishing platform that steals Microsoft 365 passwords and session cookies, and it ships a browser extension called Forge Cookie that automatically refreshes stolen session data. Removing it would change what happens in the video. Microsoft 365: (a) it ACTS - it is the target of the phishing attacks, and its login and OAuth flow are used by the attackers. Removing it would change what happens in the video. ZeroBay: (b) it merely APPEARS - researchers at ZeroBay discovered the phishing kit. Removing it would not change what happens in the video.

Call to action

Follow for more cyber news

On-screen text

PHISHING PLATFORM CALLED FORG365 JUST STEAL YOUR Microsoft 365 PASSWORD IT KEEPS STEALING YOUR ACCESS ON AUTO PILOT AFTER YOU'VE CHANGED IT WORKS FORG365 WORKS FORG365 A SERVICE BASICALLY A SUBSCRIPTION DASHBOARD FOR RUNNING PHISHING CAMPAIGNS RESEARCHERS AT ZERO B GOT ACCESS TO IT RUNS TWO ATTACK PATHS AGAINST MICROSOFT ACCOUNTS ONE IS DEVICE YOU'RE SHOWN A FAKE MICROSOFT VERIFICATION PAGE AND TALKED INTO LIKE A LOGIN EXCEPT YOU'RE ACTUALLY AUTHORIZING THE ATTACKER'S THROUGH MICROSOFT'S REAL OAUTH FLOW THE OTHER PATH IS ADVERSARY IN THE MIDDLE AND THE PLATFORM PROXIES YOUR LOGIN IN REAL TIME AND STEALS YOUR MOMENT YOU AUTHENTICATE THERE'S MORE TO THE SERVICE THOUGH STEALING THE COOKIE OF IT FORG365 SHIPS A BROWSER EXTENSION CALLED FORGE COOKIE THAT AUTOMATICALLY REFRESHES THE STOLEN MICROSOFT IN THE BACKGROUND IT REQUESTS FRESH ACCOUNT DATA CLEARS OUT OLD COOKIES QUIETLY TRIGGERS A NEW LOGIN FLOW TO GRAB YOUR CURRENT TOKENS ATTACKER DOESN'T LOSE ACCESS WHEN THEY NATURALLY EXPIRE IS BUILT RIGHT INTO THE OPERATOR'S GENERATING AND REFINING THE PHISHING EMAILS ON SCREEN THE POST COMPROMISE TOOLS A PHISHING KIT IT'S PERSISTENT ACCOUNT TAKEOVER AS A SUBSCRIPTION MADE IT CHEAPER RUN FOLLOW FOR MORE CYBER NEWS

Transcript

A new phishing platform called Forg365 steals your Microsoft 365 password. It keeps stealing your access on auto pilot after you've changed it. How it works. Forg365 is a service, basically a subscription dashboard for running phishing campaigns. Researchers at ZeroBay got access to it. It runs two attack paths against Microsoft accounts. One is device. You're shown a fake Microsoft verification page and talked into like a login, except you're actually authorizing the attacker's through Microsoft's real OAuth flow. The other path is adversary in the middle, and the platform proxies your login in real time and steals your session cookie the moment you authenticate. There's more to the service though. Stealing the cookie isn't the end of it. Forg365 ships a browser extension called Forge Cookie that automatically refreshes the stolen Microsoft session in the background. It requests fresh account data, clears out old cookies, quietly triggers a new login flow to grab your current tokens. The attacker doesn't lose access when they naturally expire. AI is built right into the operator's generating and refining the phishing emails on the same screen used to run the post compromise tools. This isn't just a phishing kit, it's persistent account takeover as a subscription. Made it cheaper and easier to run. Follow for more cyber news.