[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fXEL2Dm2dc9loRUlZM-zjSVJ57FIMsf0XWEdjEN32udA":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":51,"controls":52},"61bb5deb-c91b-454d-951f-f94c2b961f6e","phishing-as-a-service-exploits-ringcentral-branding-to-hijack-microsoft-365-accounts","1f302a8a-e1b4-4f49-974d-af1a6d9cbf21","Phishing-as-a-Service Exploits RingCentral Branding to Hijack Microsoft 365 Accounts","The Greatness PhaaS platform demonstrates how attackers are weaponizing trusted business communication brands like RingCentral to craft convincing lures — voicemails and performance reviews — that bypass email security filters. By deploying adversary-in-the-middle (AiTM) techniques, attackers intercept both credentials and live MFA tokens, effectively defeating traditional multi-factor authentication protections. This matters because stolen session tokens grant persistent access to Microsoft 365 environments without requiring repeated authentication, enabling long-term espionage or data exfiltration. Organizations that rely solely on MFA as a 'silver bullet' without monitoring for suspicious sign-in patterns or anomalous token usage remain highly exposed to this class of attack.","**Immediate actions:**\n- Deploy phishing-resistant MFA methods such as FIDO2\u002Fpasskeys that are immune to AiTM token interception.\n- Configure conditional access policies in Microsoft 365 to block sign-ins from unexpected geolocations, devices, or IP ranges.\n- Train users to verify voicemail and HR communications through official internal channels before clicking any embedded links.\n\n**Detection measures:**\n- Enable Microsoft Entra ID (Azure AD) sign-in risk policies and alert on anomalous token usage or impossible travel events.\n- Monitor for device-code authentication flows originating from unexpected or unmanaged devices, as these are a key AiTM indicator.\n- Implement a SIEM rule to flag Microsoft 365 logins that occur immediately after a RingCentral-spoofed email is delivered.\n\n**Long-term improvements:**\n- Adopt a Zero Trust architecture requiring continuous session validation rather than trusting authenticated sessions indefinitely.\n- Integrate email security gateways with brand impersonation detection capable of flagging spoofed third-party SaaS vendors like RingCentral.\n- Conduct regular phishing simulation exercises specifically targeting AiTM and business communication lure scenarios to build user resilience.",[12,13,14,15,16,17,18,19,20,21,22,23],"CIS Control 4 – Secure Configuration of Enterprise Assets","CIS Control 6 – Access Control Management","CIS Control 9 – Email and Web Browser Protections","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-63B – Digital Identity Guidelines (Phishing-Resistant AAL3)","NIST AC-7 – Unsuccessful Logon Attempts","NIST SI-3 – Malicious Code Protection","NIST IR-5 – Incident Monitoring","MITRE ATT&CK T1557 – Adversary-in-the-Middle","MITRE ATT&CK T1528 – Steal Application Access Token","GDPR Article 32 – Security of Processing (technical measures to ensure confidentiality)","ITIL – Continual Improvement (Security Awareness Training)",{},"published","2026-08-04T22:20:20.619251+00:00","2026-08-04T22:20:20.526+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fphishing-service-spoofs-ringcentral-to-steal-microsoft-365-accounts\u002F","phishing-service-spoofs-ringcentral-to-steal-microsoft-365-accounts-27d168","Phishing service spoofs RingCentral to steal Microsoft 365 accounts",[33,39,45],{"id":34,"name":35,"slug":36,"description":37,"color":38},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":40,"name":41,"slug":42,"description":43,"color":44},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":46,"name":47,"slug":48,"description":49,"color":50},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",[],[53,57,61],{"slug":54,"name":55,"problem":56},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":58,"name":59,"problem":60},"email-authentication","Email authentication (DMARC)","Nobody can send email that pretends to come from your domain.",{"slug":62,"name":63,"problem":64},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes."]