Phishing service spoofs RingCentral to steal Microsoft 365 accounts
Phishing service Greatness spoofs RingCentral to steal Microsoft 365 accounts via AiTM and device-code phishing.
The Greatness phishing-as-a-service platform has evolved to conduct adversary-in-the-middle (AiTM) and device-code phishing attacks targeting Microsoft 365 accounts. Attackers are abusing RingCentral communications to bypass email filters, using fake voicemail and performance review lures. The stolen credentials and MFA tokens allow for persistent access to Microsoft 365 services.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft 365?
Get an email when a new story names Microsoft 365, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Greatness PhaaS platform demonstrates how attackers are weaponizing trusted business communication brands like RingCentral to craft convincing lures — voicemails and performance reviews — that bypass email security filters. By deploying adversary-in-the-middle (AiTM) techniques, attackers intercept both credentials and live MFA tokens, effectively defeating traditional multi-factor authentication protections. This matters because stolen session tokens grant persistent access to Microsoft 365 environments without requiring repeated authentication, enabling long-term espionage or data exfiltration. Organizations that rely solely on MFA as a 'silver bullet' without monitoring for suspicious sign-in patterns or anomalous token usage remain highly exposed to this class of attack.
What helps against this
How we list vendors
- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Email authentication (DMARC)
Nobody can send email that pretends to come from your domain.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.