cyber.hendryadrian.com
Security News · bleepingcomputer.com

Greatness Phishing Service Uses RingCentral Branding to Steal Microsoft 365 Tokens

· Original article ↗

Summary

Researchers say Greatness is using RingCentral-themed lures to bypass email filters and capture Microsoft 365 tokens through AiTM or device-code phishing, then access mailboxes and cloud data; access persisted over two weeks in some cases.

Key points

  • Greatness has been active since at least mid-2022 and now targets Microsoft 365, iCloud, Yahoo, and Google Workspace accounts; the service is reportedly sold for $289 per month.
  • Researchers observed fake RingCentral voicemail and performance-review emails that passed filters despite failed SPF and DMARC checks and no DKIM signature, reportedly because RingCentral was whitelisted.
  • The lures routed victims to adversary-in-the-middle flows that captured MFA-approved tokens or to device-code phishing flows.
  • Attackers reportedly replayed Microsoft 365 tokens from VPS and commercial VPN infrastructure, then used Microsoft Graph to access mailboxes, Teams, SharePoint, OneDrive, and other account data.
  • Access reportedly persisted for more than two weeks in some cases.
  • Researchers said a connection between the campaign's target list and the RingCentral breach claimed by ShinyHunters was possible but could not be confidently established.
  • Recommended defenses include reviewing safe-sender rules, requiring valid email authentication, hunting for suspicious sign-ins, and revoking tokens and reviewing OAuth consent if compromise is suspected.

Article Details

Event Type
Greatness phishing-as-a-service activity impersonating RingCentral and using adversary-in-the-middle and device-code phishing to target Microsoft 365 accounts.
Impact
The activity bypassed email filtering and captured or replayed Microsoft 365 authentication tokens, enabling access to mailboxes, Teams conversations, SharePoint sites, OneDrive files, and other account data. Access persisted for more than two weeks in some cases. Separately, RingCentral disclosed a data breach claimed by ShinyHunters; researchers said a connection to Greatness targeting was possible but could not confirm one.

MITRE ATT&CK

T1550.001 · Application Access TokenAttackers replayed Microsoft 365 authentication tokens to access compromised accounts.T1557 · Adversary-in-the-MiddleThe platform routed victims through adversary-in-the-middle phishing flows that captured MFA-approved authentication tokens.T1566.002 · Spearphishing LinkPhishing emails used fake voicemail and performance-review notifications with an embedded button leading victims to phishing flows.

Threat Actors

ShinyHuntersClaimed responsibility for a separate RingCentral data breach, according to the article; researchers could not confirm a connection between that incident and Greatness users' targeting.

Vendors

MicrosoftGreatness has evolved from a credential phishing service into an advanced platform that uses adversary-in-the-middle and device-code phishing to steal Microsoft 365 access tokens.RingCentralResearchers found the operators abusing RingCentral branding to bypass filters and gain prolonged access to victim mailboxes, Teams, SharePoint, and OneDrive data.

Products

GreatnessGreatness has evolved from a credential phishing service into an advanced platform that uses adversary-in-the-middle and device-code phishing to steal Microsoft 365 access tokens.Microsoft 365 Apps for EnterpriseGreatness has evolved from a credential phishing service into an advanced platform that uses adversary-in-the-middle and device-code phishing to steal Microsoft 365 access tokens.Microsoft GraphSharePoint sites, OneDrive files, contacts, calendars, and registered applications through Microsoft Graph, with access persisting for more than two weeks in some cases.Microsoft OneDriveResearchers found the operators abusing RingCentral branding to bypass filters and gain prolonged access to victim mailboxes, Teams, SharePoint, and OneDrive data.Microsoft SharePointResearchers found the operators abusing RingCentral branding to bypass filters and gain prolonged access to victim mailboxes, Teams, SharePoint, and OneDrive data.RingCentralResearchers found the operators abusing RingCentral branding to bypass filters and gain prolonged access to victim mailboxes, Teams, SharePoint, and OneDrive data.TeamsResearchers found the operators abusing RingCentral branding to bypass filters and gain prolonged access to victim mailboxes, Teams, SharePoint, and OneDrive data.

Countries

AustraliaThe platform has been active since at least mid-2022, targeting Microsoft 365 users in the United States, Canada, the UK, Australia, and South Africa.CanadaThe platform has been active since at least mid-2022, targeting Microsoft 365 users in the United States, Canada, the UK, Australia, and South Africa.South AfricaThe platform has been active since at least mid-2022, targeting Microsoft 365 users in the United States, Canada, the UK, Australia, and South Africa.United KingdomThe platform has been active since at least mid-2022, targeting Microsoft 365 users in the United States, Canada, the UK, Australia, and South Africa.United StatesThe platform has been active since at least mid-2022, targeting Microsoft 365 users in the United States, Canada, the UK, Australia, and South Africa.

Related Articles