All three operations were Evilginx-based AiTM phishing campaigns that proxied Microsoft 365 login pages to steal session tokens after the user completed MFA . One of the three campaigns had logged 218 captured accounts across 12 countries, of which 94% were corporate mailboxes . The operations used two distinct attack paths: Evilginx session token theft (via an AiTM proxy) and device code phishing — one kit sent victims to the real Microsoft device login page, where they authorized access themselves, and the attacker's backend polled for the token .

Forg365: A Commercial Phishing-as-a-Service Platform

Separately, the Forg365 phishing-as-a-service (PhaaS) platform was identified by ZeroBEC researchers (reported July 9–13, 2026) as a commercial Telegram-distributed kit that costs $400 per month (or $3,800 per year). Unlike the custom Evilginx forks found on the exposed server, Forg365 bundles multiple attack methods and tools into a single operator dashboard .

Forg365 combines three core capabilities:

• AiTM proxying — a transparent reverse proxy that captures session tokens after the user completes MFA
• Device code phishing — abuses Microsoft's legitimate OAuth device-code flow, meaning the user completes authentication on a real Microsoft page without the attacker ever seeing their password
• AI-assisted lure generation — uses AI to craft convincing phishing emails and landing pages that impersonate SharePoint, OneDrive, DocuSign, and Adobe Acrobat Sign

The platform also includes antibot evasion (detects sandboxes and security crawlers), post-compromise mailbox access (operators can browse and exfiltrate email from within the panel), SMTP rotation, and campaign scheduling .

One Attack Steals Tokens After MFA; the Other Abuses a Legitimate Protocol

These two discoveries illustrate the critical distinction between AiTM proxy attacks and device code abuse. Understanding the difference is essential because the same defense does not work for both:

• AiTM proxy attacks (Evilginx-style): The attacker sets up a fake login page that proxies traffic to the real Microsoft login page. The user enters their password and completes MFA on the attacker's proxy. After successful authentication, Microsoft issues a session cookie to what it believes is the legitimate user's browser — but that cookie actually lands in the attacker's proxy, not the user's browser. The attacker can then replay that cookie to access the victim's Microsoft 365 account .

• Device code phishing: The attacker generates a legitimate Microsoft device code (a short code used to sign in on devices without keyboards, like smart TVs) and sends it to the victim in a phishing email. The victim visits the real Microsoft login page, enters the code, completes MFA, and authorizes the attacker's application. Nothing is "bypassed" — the victim has authorized access. The attacker's backend then polls Microsoft for the token .

Recommended Defenses: Which Controls Stop Each Attack

Defenses Against Adversary-in-the-Middle Proxy Attacks (Evilginx-style)

The single most effective defense against AiTM proxy attacks is phishing-resistant MFA, specifically FIDO2/WebAuthn and passkeys. These bind credentials to the legitimate domain name, so when the user's browser connects to the attacker's proxy site (which has a different domain), the authentication protocol detects the domain mismatch and blocks the credential exchange automatically .

Other defenses include:

• Conditional Access policies (Entra ID): Require device compliance and trusted-location requirements to block token issuance from untrusted proxies
• Continuous Access Evaluation (CAE): Enables near-real-time token revocation when risky conditions are detected
• Monitor for anomalous token usage: Look for tokens used from a different IP or country than where they were issued, impossible travel, and "unfamiliar sign-in properties"
• Block newly registered phishing domains: Monitor domains registered in the last 30 days that resolve to known hosting IP ranges used for phishing infrastructure

Defenses Against Device Code Authentication Abuse

Device code phishing does not require the attacker to trick the user into entering credentials on a fake page — the user interacts with the real Microsoft login page. This means FIDO2/passkeys alone do not fully protect against this attack because the legitimate OAuth flow is being used .

The primary defense is to block the device-code OAuth grant for users who do not need it, using Microsoft Entra ID Conditional Access:

• Create a policy using the "Authentication Flows" condition to block device code flow for all users except a documented exception group
• Before blocking, run in report-only mode or check historical sign-in logs to identify legitimate device-code usage (e.g., smart TVs, conference-room devices)
• Plan for a Device Registration Service (DRS) exception, because blocking device code flow can interfere with Autopilot and Windows device enrollment

Additional defenses:

• Restrict app consent and OAuth grant scopes: Limit which apps can use device-code grants and audit consented applications regularly
• Deploy phishing-resistant MFA even for device-code flows: While not a complete fix, FIDO2 hardware keys or certificate-based authentication still reduce the attack surface

The Bottom Line

The FBI's May 2026 Public Service Announcement on the Kali365 PhaaS platform specifically recommended blocking device code flow as the primary defense . As phishing platforms like Forg365 continue to commercialize these attack techniques, the operational urgency for defenders is clear: deploy FIDO2/passkeys for all privileged accounts to stop AiTM proxy attacks, and use Conditional Access to disable the device-code grant for users who do not need it. One open directory may have exposed three campaigns — but the lessons apply to every Microsoft 365 tenant.

All three operations were Evilginx-based AiTM phishing campaigns that proxied Microsoft 365 login pages to steal session tokens after the user completed MFA . One of the three campaigns had logged 218 captured accounts across 12 countries, of which 94% were corporate mailboxes . The operations used two distinct attack paths: Evilginx session token theft (via an AiTM proxy) and device code phishing — one kit sent victims to the real Microsoft device login page, where they authorized access themselves, and the attacker's backend polled for the token .

Forg365: A Commercial Phishing-as-a-Service Platform

Separately, the Forg365 phishing-as-a-service (PhaaS) platform was identified by ZeroBEC researchers (reported July 9–13, 2026) as a commercial Telegram-distributed kit that costs $400 per month (or $3,800 per year). Unlike the custom Evilginx forks found on the exposed server, Forg365 bundles multiple attack methods and tools into a single operator dashboard .

Forg365 combines three core capabilities:

• AiTM proxying — a transparent reverse proxy that captures session tokens after the user completes MFA
• Device code phishing — abuses Microsoft's legitimate OAuth device-code flow, meaning the user completes authentication on a real Microsoft page without the attacker ever seeing their password
• AI-assisted lure generation — uses AI to craft convincing phishing emails and landing pages that impersonate SharePoint, OneDrive, DocuSign, and Adobe Acrobat Sign

The platform also includes antibot evasion (detects sandboxes and security crawlers), post-compromise mailbox access (operators can browse and exfiltrate email from within the panel), SMTP rotation, and campaign scheduling .

One Attack Steals Tokens After MFA; the Other Abuses a Legitimate Protocol

These two discoveries illustrate the critical distinction between AiTM proxy attacks and device code abuse. Understanding the difference is essential because the same defense does not work for both:

• AiTM proxy attacks (Evilginx-style): The attacker sets up a fake login page that proxies traffic to the real Microsoft login page. The user enters their password and completes MFA on the attacker's proxy. After successful authentication, Microsoft issues a session cookie to what it believes is the legitimate user's browser — but that cookie actually lands in the attacker's proxy, not the user's browser. The attacker can then replay that cookie to access the victim's Microsoft 365 account .

• Device code phishing: The attacker generates a legitimate Microsoft device code (a short code used to sign in on devices without keyboards, like smart TVs) and sends it to the victim in a phishing email. The victim visits the real Microsoft login page, enters the code, completes MFA, and authorizes the attacker's application. Nothing is "bypassed" — the victim has authorized access. The attacker's backend then polls Microsoft for the token .

Recommended Defenses: Which Controls Stop Each Attack

Defenses Against Adversary-in-the-Middle Proxy Attacks (Evilginx-style)

The single most effective defense against AiTM proxy attacks is phishing-resistant MFA, specifically FIDO2/WebAuthn and passkeys. These bind credentials to the legitimate domain name, so when the user's browser connects to the attacker's proxy site (which has a different domain), the authentication protocol detects the domain mismatch and blocks the credential exchange automatically .

Other defenses include:

• Conditional Access policies (Entra ID): Require device compliance and trusted-location requirements to block token issuance from untrusted proxies
• Continuous Access Evaluation (CAE): Enables near-real-time token revocation when risky conditions are detected
• Monitor for anomalous token usage: Look for tokens used from a different IP or country than where they were issued, impossible travel, and "unfamiliar sign-in properties"
• Block newly registered phishing domains: Monitor domains registered in the last 30 days that resolve to known hosting IP ranges used for phishing infrastructure

Defenses Against Device Code Authentication Abuse

Device code phishing does not require the attacker to trick the user into entering credentials on a fake page — the user interacts with the real Microsoft login page. This means FIDO2/passkeys alone do not fully protect against this attack because the legitimate OAuth flow is being used .

The primary defense is to block the device-code OAuth grant for users who do not need it, using Microsoft Entra ID Conditional Access:

• Create a policy using the "Authentication Flows" condition to block device code flow for all users except a documented exception group
• Before blocking, run in report-only mode or check historical sign-in logs to identify legitimate device-code usage (e.g., smart TVs, conference-room devices)
• Plan for a Device Registration Service (DRS) exception, because blocking device code flow can interfere with Autopilot and Windows device enrollment

Additional defenses:

• Restrict app consent and OAuth grant scopes: Limit which apps can use device-code grants and audit consented applications regularly
• Deploy phishing-resistant MFA even for device-code flows: While not a complete fix, FIDO2 hardware keys or certificate-based authentication still reduce the attack surface

The Bottom Line

The FBI's May 2026 Public Service Announcement on the Kali365 PhaaS platform specifically recommended blocking device code flow as the primary defense . As phishing platforms like Forg365 continue to commercialize these attack techniques, the operational urgency for defenders is clear: deploy FIDO2/passkeys for all privileged accounts to stop AiTM proxy attacks, and use Conditional Access to disable the device-code grant for users who do not need it. One open directory may have exposed three campaigns — but the lessons apply to every Microsoft 365 tenant.