[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fG7F1jO8obuZ33_81ml7tHkMIX-p0tlEf8VjWdmHi9C8":3},{"article":4,"iocs":49,"watch_terms":50,"solutions":51,"lesson":142},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"1f302a8a-e1b4-4f49-974d-af1a6d9cbf21","Phishing service spoofs RingCentral to steal Microsoft 365 accounts","phishing-service-spoofs-ringcentral-to-steal-microsoft-365-accounts-27d168","The Greatness phishing-as-a-service (PhaaS) platform has expanded from credential phishing to adversary-in-the-middle attacks and device-code phishing targeting Microsoft 365 accounts. [...]","The Greatness phishing-as-a-service platform has evolved to conduct adversary-in-the-middle (AiTM) and device-code phishing attacks targeting Microsoft 365 accounts. Attackers are abusing RingCentral communications to bypass email filters, using fake voicemail and performance review lures. The stolen credentials and MFA tokens allow for persistent access to Microsoft 365 services.","Phishing service Greatness spoofs RingCentral to steal Microsoft 365 accounts via AiTM and device-code phishing.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fphishing-service-spoofs-ringcentral-to-steal-microsoft-365-accounts\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2024\u002F05\u002F13\u002FPhishing.jpg","2026-08-04T21:45:36+00:00","2026-08-04T22:00:17.73918+00:00",8,[17,20,22,24,27,29],{"name":18,"type":19},"Microsoft 365","product",{"name":21,"type":19},"RingCentral",{"name":23,"type":19},"Greatness",{"name":25,"type":26},"phishing-as-a-service","technology",{"name":28,"type":26},"adversary-in-the-middle",{"name":30,"type":26},"device-code phishing","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":31,"icon":33,"name":34,"slug":35},null,"Threat Intelligence","threat-intelligence",[37,42,47],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":48},{"id":31,"icon":33,"name":34,"slug":35},[],[18,21,23],{"controls":52,"vendors":138},[53,82,109],{"slug":54,"name":55,"problem":56,"products":57},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[58,66,74],{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"slug":83,"name":84,"problem":85,"products":86},"email-authentication","Email authentication (DMARC)","Nobody can send email that pretends to come from your domain.",[87,95,103],{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"valimail","Valimail","\u002Fvendor-logos\u002Fvalimail.png","valimail-enforce","Valimail Enforce","https:\u002F\u002Fwww.valimail.com\u002Fproducts\u002Fenforce\u002F","Automated DMARC enforcement with discovery of every service that sends mail as your domain.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","email-fraud-defense","Proofpoint Email Fraud Defense","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-fraud-defense","DMARC deployment and monitoring with hosted SPF and DKIM services.",{"vendor_slug":104,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":104,"url":107,"description":108},"dmarcian","\u002Fvendor-logos\u002Fdmarcian.png","dmarcian-platform","https:\u002F\u002Fdmarcian.com\u002F","DMARC report processing and guidance for moving domains to enforcement.",{"slug":110,"name":111,"problem":112,"products":113},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[114,122,130],{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",[139],{"slug":67,"name":68,"logo_path":69,"roles":140},[141],"affected",{"slug":143,"title":144,"body":145,"framework_refs":146,"framework_notes":159},"phishing-as-a-service-exploits-ringcentral-branding-to-hijack-microsoft-365-accounts","Phishing-as-a-Service Exploits RingCentral Branding to Hijack Microsoft 365 Accounts","The Greatness PhaaS platform demonstrates how attackers are weaponizing trusted business communication brands like RingCentral to craft convincing lures — voicemails and performance reviews — that bypass email security filters. By deploying adversary-in-the-middle (AiTM) techniques, attackers intercept both credentials and live MFA tokens, effectively defeating traditional multi-factor authentication protections. This matters because stolen session tokens grant persistent access to Microsoft 365 environments without requiring repeated authentication, enabling long-term espionage or data exfiltration. Organizations that rely solely on MFA as a 'silver bullet' without monitoring for suspicious sign-in patterns or anomalous token usage remain highly exposed to this class of attack.",[147,148,149,150,151,152,153,154,155,156,157,158],"CIS Control 4 – Secure Configuration of Enterprise Assets","CIS Control 6 – Access Control Management","CIS Control 9 – Email and Web Browser Protections","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-63B – Digital Identity Guidelines (Phishing-Resistant AAL3)","NIST AC-7 – Unsuccessful Logon Attempts","NIST SI-3 – Malicious Code Protection","NIST IR-5 – Incident Monitoring","MITRE ATT&CK T1557 – Adversary-in-the-Middle","MITRE ATT&CK T1528 – Steal Application Access Token","GDPR Article 32 – Security of Processing (technical measures to ensure confidentiality)","ITIL – Continual Improvement (Security Awareness Training)",{}]