Greatness Phishing-as-a-Service Platform Expands to AiTM and Device-Code Attacks The Greatness phishing-as-a-service (PhaaS) platform, active since mid-2022, has evolved from credential phishing to more sophisticated adversary-in-the-middle (AiTM) and device-code phishing attacks targeting Microsoft 365 accounts. Initially focused on Microsoft 365 users in the U.S., Canada, the UK, Australia, and South Africa, the platform now also targets iCloud, Yahoo, and Google Workspace. Cybercriminals can subscribe to Greatness for $289 per month via a Telegram channel with thousands of users. In a recent campaign uncovered by email security firm ZeroBEC, Greatness operators exploited RingCentral a business communications platform to bypass email security filters. Attackers spoofed RingCentral’s domain (service@ringcentral[.]com), sending fake voicemail and performance-review notifications to legitimate users. Despite failing SPF, DMARC, and DKIM checks, the emails evaded detection because RingCentral was whitelisted, achieving a Spam Confidence Level (SCL) of -1 on Microsoft Exchange. A fraudulent "verified sender" banner further reduced suspicion. Victims who clicked embedded links were redirected to Greatness infrastructure, where they faced either an AiTM phishing flow capturing MFA-approved authentication tokens or a device-code phishing attack. Post-compromise, attackers replayed stolen tokens from VPS and commercial VPNs to access Outlook mailboxes, Teams chats, SharePoint, OneDrive files, and other Microsoft 365 data, with persistence lasting over two weeks in some cases. While RingCentral recently disclosed a data breach linked to the ShinyHunters threat actor, ZeroBEC notes that Greatness operators may have obtained target lists from this incident, though no direct connection has been confirmed. The attack highlights risks of overbroad safe-sender lists and underscores the need for stricter email authentication controls. Organizations are advised to audit whitelisted domains, monitor for Greatness infrastructure, and investigate suspicious MFA-approved logins from hosting or VPN sources.

RingCentral Hit by ShinyHunters Extortion Attack, 1.6M Email Addresses Leaked Last month, cloud communications provider RingCentral fell victim to an extortion attack by the cybercriminal group ShinyHunters, which later published 1.6 million email addresses and other personal data allegedly stolen from the company. The leaked data was cross-referenced with existing breaches, revealing that 44% of the exposed email addresses were already present in LinkedIn’s records and other third-party databases. The incident highlights the growing risk of credential reuse and the potential for further exploitation by threat actors. ShinyHunters, known for targeting high-profile organizations, has previously been linked to breaches involving stolen databases sold or leaked on underground forums. The full scope of the compromised data beyond email addresses remains unclear, but the exposure underscores the persistent threat of extortion-driven cyberattacks in enterprise environments. The breach was confirmed by security researcher Troy Hunt, who added the exposed emails to the Have I Been Pwned database, allowing users to check for potential exposure. No official statement from RingCentral regarding the attack’s impact or mitigation efforts has been released at this time.