Greatness PhaaS Spoofs RingCentral to Steal Microsoft 365 Accounts

Operators leveraging the Greatness phishing-as-a-service (PhaaS) platform have launched a sophisticated campaign targeting Microsoft 365 accounts by impersonating the RingCentral business communications platform. By exploiting common enterprise mail-filter configurations, the attackers are delivering lures directly to user inboxes, bypassing email security defenses, and routing victims into adversary-in-the-middle (AiTM) and device-code phishing flows.

First identified in mid-2022, Greatness has evolved into a full-featured PhaaS kit sold for $289 per month across a Telegram channel boasting thousands of subscribers. While historically focused on basic credential harvesting across Microsoft 365, Google Workspace, iCloud, and Yahoo users in the US, UK, Canada, Australia, and South Africa, recent activity analyzed by email security firm ZeroBEC shows the platform adopting advanced authentication bypass tactics designed to defeat multi-factor authentication (MFA).

Mail-Filter Bypass via Misconfigured Safe-Sender Lists

The core vector of this campaign relies on domain spoofing allowed by flawed email trust configurations. Threat actors distributed phishing emails claiming to originate from service@ringcentral[.]com, utilizing lures centered on missed voicemail notifications and annual performance reviews—typical communications for RingCentral corporate users.

Although the messages were dispatched from unrelated IONOS mail servers, lacked DKIM signatures, and failed both SPF and DMARC checks, receiving mail servers accepted them. The target organizations had placed RingCentral’s domain on internal safe-sender lists or blanket exclusion rules within Exchange Online Protection (EOP).

Because safe-sender allowlists override standard spam filtering rules, Microsoft Exchange designated these messages with a Spam Confidence Level (SCL) of -1. An SCL value of -1 forces Exchange to trust the message and bypass standard filtering pipeline stages, delivering the email directly to the primary inbox. To further reduce human suspicion, the attackers injected a fraudulent email banner into the message body falsely claiming the sender had been verified by the organization’s safe-sender list.

How Greatness Executes AiTM and Device-Code Attacks

When a victim interacts with the embedded link, Greatness infrastructure evaluates the target and routes them into one of two session-hijacking workflows:

1. Adversary-in-the-Middle (AiTM) Proxying: The target is directed to a reverse-proxy server that mirrors legitimate Microsoft 365 authentication interfaces. As the victim enters their credentials and completes their MFA challenge (such as an authenticator push or TOTP code), the proxy intercepts the session tokens returned by Microsoft’s identity provider.
2. Device-Code Phishing: The attack leverages the OAuth 2.0 Device Authorization Grant flow designed for input-constrained devices. The victim is prompted to enter an attacker-generated device code on Microsoft’s legitimate login page (microsoft.com/devicelogin). Once the user authenticates and approves the device request, Microsoft issues valid tokens directly to the attacker’s session.

Both mechanisms allow the threat actors to bypass MFA entirely without needing to crack passwords or duplicate authenticator apps.

Post-Compromise Enumeration and Blast Radius

Following successful token acquisition, Greatness subscribers replay the captured Microsoft 365 session tokens using Virtual Private Server (VPS) infrastructure and commercial VPN services to evade geographic login anomalies. In observed deployments, attacker access persisted for over two weeks.

Once inside the tenant, the threat actors rely heavily on the Microsoft Graph API (graph.microsoft.com) to systematically enumerate the compromised enterprise environment. Exfiltrated data and resources include:

• Full Outlook mailbox contents and historical correspondence
• Microsoft Teams message logs and internal chat attachments
• Files hosted across SharePoint sites and personal OneDrive repositories
• Organization-wide contact lists and user calendars
• Registered Azure Active Directory (Entra ID) applications and service principals

The realistic blast radius for targeted organizations extends well beyond account compromise. Access to Microsoft Graph enables threat actors to execute internal business email compromise (BEC), conduct lateral spear-phishing from trusted internal accounts, steal proprietary enterprise data, and establish persistent backdoor access via consent grants on malicious OAuth applications.

Likely Link to July RingCentral Breach

ZeroBEC noted that this campaign specifically targets legitimate RingCentral enterprise clients. On July 28, RingCentral acknowledged a data breach affecting a subset of its corporate customers—an incident publicly claimed by the ShinyHunters extortion group.

While a definitive technical link between the two events remains unconfirmed, threat actor groups operating PhaaS kits frequently acquire victim directories exfiltrated during third-party SaaS breaches to refine their targeting lists. Possessing an authentic client list enables operators to deploy RingCentral-themed lures exclusively to organizations known to utilize the service, significantly increasing click-through rates.

Mitigations and Threat Hunting Recommendations

Security teams should immediately take concrete technical steps to neutralize this exposure:

• Audit EOP and SEG Allowlists: Inspect Exchange Online Protection, Transport Rules, and Secure Email Gateway configurations. Immediately remove blanket domain or email address exclusions for third-party SaaS providers like RingCentral. Configure rules to enforce SPF, DKIM, and DMARC validation before any domain allowlist status is honored.
• Hunt for Session Token Abuse: Query Azure AD / Entra ID sign-in logs for MFA-approved interactive sign-ins originating from commercial VPN providers (e.g., Mullvad, Nord, ExpressVPN) or hosting provider ASNs (e.g., DigitalOcean, M247, Hostinger) immediately following device-code or web logins.
• Remediate Suspected Account Takeover: If a Greatness compromise is identified, immediately revoke all user access and refresh tokens using the Azure AD PowerShell cmdlet Revoke-AzureADUserAllRefreshToken or via the Entra ID admin portal. Audit the account’s OAuth application consent grants, inspect Unified Audit Logs (UAL) for anomalous Microsoft Graph API calls, and audit mailbox forwarding rules.