Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
1 IOC
Forg365 PhaaS Abuses Microsoft Device-Code Flow to Hijack M365 Sessions
Excerpt
A newly identified phishing-as-a-service (PhaaS) platform , Forg365, is abusing Microsoft’s device code authentication flow to hijack Microsoft 365 sessions at scale. ZeroBEC researchers uncovered the platform after tracing a business-document-themed phishing email back to a fully productized operator panel that offered AI-generated lures, token theft, and persistent session access as a subscription service. Forg365 operates on a SaaS-style business model, distributed…
Read the original report →Diamond Model
Adversary
Infrastructure(1)
Capability
Victim
Attack Flow8 steps · MITRE ATT&CK mapped
Indicators of Compromise
Open the mindmap →1 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | logfriend.com | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…