Key takeaways
Modern Microsoft 365 phishing kits steal your session token, not just your password, so MFA alone no longer protects the account.
One common method, adversary-in-the-middle (AitM), routes you through a fake Microsoft login page that relays your credentials and captures the session in real time.
These kits are sold as a service, complete with AI-generated lures and delivery through legitimate email infrastructure, which lowers the skill needed to run a campaign.
The fake login page is the step Haven is built to catch, before an employee enters anything.
A second method, device code phishing, uses real Microsoft pages, so it needs admin-side controls (block device code auth, phishing-resistant MFA) rather than page detection.
Multi-factor authentication was supposed to make stolen passwords useless. Attackers found a way around it: instead of just taking your password, they take your live session, the thing MFA already approved. A new generation of Microsoft 365 phishing kits is built to do exactly that, and they are sold by subscription to anyone who wants them.
For any business running Microsoft 365, this is the threat to understand right now. Here is how it works, and what actually stops it.
What's happening
Security researchers recently detailed a phishing-as-a-service operation called Forg365, reported by The Hacker News based on analysis by ZeroBAC. For about $400 a month, it gives operators a full kit for attacking Microsoft 365 accounts: AI-generated lures, delivery through legitimate services like Amazon SES and SendGrid to blend into normal email traffic, evasion that serves a harmless decoy to security scanners, and tools to manage the stolen tokens afterward.
It is part of a growing ecosystem of these kits (Sneaky 2FA, Kali365, and others). The common thread is that they have industrialized session theft. The goal is no longer just your password. It is the authenticated session behind it.
Why MFA is not enough anymore
When you sign in and approve MFA, the service issues your browser a session token, a kind of pass that says "this person already proved who they are." Steal that token and an attacker can load it into their own browser and be you, without a password and without triggering another MFA prompt.
That is the shift. Password theft asks you for a secret. Session theft steals the proof that you already passed the check. This is why so many recent breaches happen to accounts that had MFA turned on.
The two techniques, and which one Haven catches
The kits use two main methods, and they are important to tell apart, because they call for different defenses.
Adversary-in-the-middle (AitM). The victim is sent to a fake Microsoft login page that sits between them and the real Microsoft. It looks exactly like the genuine sign-in, but it is a relay: whatever you type is passed to Microsoft in real time, and the attacker captures both your credentials and the resulting session token. This is a fake login page, and it is the moment Haven is designed to catch.
Device code phishing. Here the attacker shows a Microsoft-styled prompt asking you to enter a short code, then walks you through the real Microsoft sign-in flow. The pages are genuine Microsoft, so there is nothing fake to detect. The trick is convincing you to approve a code that authorizes the attacker's device. Because the login surface is real, this one is not stopped by page detection, it is stopped by admin controls.
The distinction matters. One of these lives on a fake page. The other lives on real Microsoft pages plus social engineering.
How Haven helps with the fake-login half
Haven is designed to catch fake and impersonated login pages at the moment an employee is about to enter credentials. In an AitM attack, the whole scheme depends on that fake Microsoft sign-in page in the middle. Because Haven analyzes the actual page rather than trusting how it looks or how the person arrived, it can flag the impersonated Microsoft login before anything is typed, which is the step where the credential and session theft would happen.
It does not matter how the link was delivered, a business-document lure, a compromised sender, or a redirect chain through legitimate services. Haven checks the page itself. We wrote about the same fake-Microsoft-login pattern arriving a different way in our piece on hotel Wi-Fi phishing, where a hijacked network sends travelers to a fake Microsoft page. The delivery changes; the decisive moment, the fake login page, stays the same, and that is Haven's layer. If an employee is unsure about a link, they can also check it with Haven's free link checker before clicking.
To be precise about scope: Haven addresses the AitM fake-login-page half. Device code phishing runs on real Microsoft pages, so Haven does not flag it, that variant needs the admin-side controls below. We would rather be clear about that than overclaim.
What businesses should do
Defense here is layered, because these kits attack from more than one angle:
Deploy phishing-resistant MFA. Passkeys and FIDO2 security keys resist AitM relay attacks in a way that codes and push approvals do not, because the credential is bound to the real domain.
Block device code authentication unless a specific workflow requires it, and alert on device-code sign-in events.
Use conditional access and token protection so a stolen session is harder to replay from a new device or location.
Audit mailbox rules and legacy email aliases, which these kits abuse for delivery and post-compromise persistence.
Add browser-layer detection of fake login pages, so an AitM Microsoft sign-in is flagged for the employee before credentials are entered.
Train employees on the specific lures, especially unexpected document or approval requests that lead to a Microsoft sign-in.
No single control catches everything, which is exactly why the attackers combine techniques. Pairing identity controls with a browser layer closes both the real-page and the fake-page paths.
About Haven
Haven is a browser extension that helps you make safer trust decisions online, before a scam can cost you anything. It works at the moment you are about to click a link or enter your password, flagging fake and impersonated login pages, suspicious links, and lookalike sites. Rather than only checking a page against a list of known-bad sites, Haven analyzes the actual page in front of you, so it can catch brand-new and convincing fakes that other tools miss.
Haven is free for individual use. For teams, Haven for Business extends this browser-level protection across every employee, and Haven for MSP lets managed service providers deliver it across their clients. Haven is operated by MirrorTab, Inc.
FAQs
How does Microsoft 365 phishing bypass MFA?
Modern phishing kits steal the session token issued after you sign in, not just your password. In an adversary-in-the-middle attack, a fake Microsoft login page relays your credentials to Microsoft in real time and captures the resulting session, so the attacker inherits an already-authenticated session without needing to pass MFA again.
What is AitM phishing?
Adversary-in-the-middle (AitM) phishing places a fake login page between the victim and the real service. It acts as a live relay, forwarding what the victim types to the genuine site and capturing both the credentials and the session cookie. This lets attackers defeat multi-factor authentication, because they steal the session that MFA already approved.
What is device code phishing, and can Haven stop it?
Device code phishing tricks a victim into entering a code that authorizes the attacker's device, using the real Microsoft sign-in pages rather than a fake one. Because the login surface is genuine, browser-based fake-page detection like Haven does not apply. It is best countered by blocking device code authentication and using phishing-resistant MFA.
How does Haven help against fake Microsoft login pages?
Haven is a browser extension that detects fake and impersonated login pages and warns the user before they enter credentials. In an AitM attack, the scheme depends on a fake Microsoft sign-in page, and Haven analyzes the actual page rather than how it looks or how the person got there, so it can flag the impersonated login regardless of how the link was delivered.
Is phishing-as-a-service really that accessible?
Yes. Kits like Forg365 are sold by subscription (around $400 a month) through channels like Telegram, and bundle lure creation, delivery, evasion, and token handling. This lowers the skill needed to run a campaign, so even operators with little technical expertise can launch account-takeover attacks at scale.
Is Haven free?
Haven is free for individual use. Haven for Business and Haven for MSP extend browser-level protection to teams and managed service providers. Haven is operated by MirrorTab, Inc.
