Phishing service spoofs RingCentral to steal Microsoft 365 accounts

The Greatness phishing-as-a-service (PhaaS) platform has evolved from credential phishing to adversary-in-the-middle (AiTM) attacks and device-code phishing targeting Microsoft 365 accounts. Active since at least mid-2022, it is sold for $289/month via a Telegram channel. In a recent campaign, operators impersonated RingCentral by spoofing the sender address as service@ringcentral[.]com. Emails used fake voicemail and performance-review notifications as lures. Though originating from an unknown IONOS mail server, failing SPF and DMARC checks, and lacking a DKIM signature, the emails bypassed email security filters because RingCentral was whitelisted, achieving a Spam Confidence Level (SCL) of -1 on Microsoft Exchange. Emails also included a fraudulent banner claiming sender verification. Victims clicking embedded links were routed to Greatness infrastructure where they encountered either a Microsoft AiTM phishing flow (capturing MFA-approved authentication tokens) or a device-code phishing flow. Post-compromise, attackers replayed Microsoft 365 authentication tokens from VPS and commercial VPN infrastructure to access accounts. They then enumerated Outlook mailboxes, Teams conversations, SharePoint sites, OneDrive files, contacts, calendars, and registered applications via Microsoft Graph, with persistence lasting more than two weeks in some cases. It is suspected that victim targeting may have leveraged data from a RingCentral data breach claimed by threat actor ShinyHunters (disclosed July 28).