Greatness has evolved from a credential phishing service into an advanced platform that uses adversary-in-the-middle and device-code phishing to steal Microsoft 365 access tokens. Researchers found the operators abusing RingCentral branding to bypass filters and gain prolonged access to victim mailboxes, Teams, SharePoint, and OneDrive data. #Greatness #RingCentral #Microsoft365 #ShinyHunters
Keypoints
- Greatness is a phishing-as-a-service platform active since at least mid-2022.
- It now targets Microsoft 365, iCloud, Yahoo, and Google Workspace accounts.
- The service is sold on Telegram for $289 per month.
- Attackers abused RingCentral branding to bypass email security filters.
- Compromised Microsoft 365 accounts were accessed through AiTM and device-code phishing flows.