Phishing-as-a-Service Exploits RingCentral Branding to Hijack Microsoft 365 Accounts
Written by AI from the linked story. Not reviewed by an editor. How this works
The Greatness PhaaS platform demonstrates how attackers are weaponizing trusted business communication brands like RingCentral to craft convincing lures — voicemails and performance reviews — that bypass email security filters. By deploying adversary-in-the-middle (AiTM) techniques, attackers intercept both credentials and live MFA tokens, effectively defeating traditional multi-factor authentication protections. This matters because stolen session tokens grant persistent access to Microsoft 365 environments without requiring repeated authentication, enabling long-term espionage or data exfiltration. Organizations that rely solely on MFA as a 'silver bullet' without monitoring for suspicious sign-in patterns or anomalous token usage remain highly exposed to this class of attack.
Tactical Insight
Immediate actions
- Deploy phishing-resistant MFA methods such as FIDO2/passkeys that are immune to AiTM token interception.
- Configure conditional access policies in Microsoft 365 to block sign-ins from unexpected geolocations, devices, or IP ranges.
- Train users to verify voicemail and HR communications through official internal channels before clicking any embedded links.
Detection measures
- Enable Microsoft Entra ID (Azure AD) sign-in risk policies and alert on anomalous token usage or impossible travel events.
- Monitor for device-code authentication flows originating from unexpected or unmanaged devices, as these are a key AiTM indicator.
- Implement a SIEM rule to flag Microsoft 365 logins that occur immediately after a RingCentral-spoofed email is delivered.
Long-term improvements
- Adopt a Zero Trust architecture requiring continuous session validation rather than trusting authenticated sessions indefinitely.
- Integrate email security gateways with brand impersonation detection capable of flagging spoofed third-party SaaS vendors like RingCentral.
- Conduct regular phishing simulation exercises specifically targeting AiTM and business communication lure scenarios to build user resilience.