The Greatness phishing-as-a-service platform has expanded beyond credential phishing to adversary-in-the-middle and device-code phishing targeting Microsoft 365 accounts, according to analysis from security firm ZeroBEC. In an observed campaign, operators abused the RingCentral platform, impersonating its sender identity with fake voicemail and performance-review lures to capture Microsoft 365 credentials and approved tokens.
How Greatness Expanded From Credential Phishing to AiTM and Device-Code Flows
Active since at least mid-2022 and sold for about $289 per month on a Telegram channel with thousands of subscribers, Greatness has grown from a credential-phishing tool into a platform that now targets Microsoft 365, iCloud, Yahoo, and Google Workspace. The expansion to adversary-in-the-middle phishing lets attackers capture MFA-approved tokens rather than just passwords, and a separate device-code flow routes victims through the legitimate device-login process in a way that can bypass many security controls.
The Device-Code and AiTM Flows That Bypass MFA
The two new techniques target Microsoft 365 users across the US, Canada, UK, Australia, and South Africa, according to the ZeroBEC analysis. In an adversary-in-the-middle flow, the attacker sits between the victim and the real sign-in page, capturing the session token a legitimate MFA approval produces. In a device-code flow, the victim is directed to enter a code on the legitimate Microsoft login endpoint, which the attacker can then use to bind the session to a device they control. Both approaches defeat the assumption that a token approved through a user’s phone is proof of a trusted sign-in.
The RingCentral Spoof and the Whitelisting Problem
In the campaign ZeroBEC observed, the operators sent emails appearing to come from service@ringcentral[.]com with fake voicemail and performance-review themes. The emails originated from an unknown mail server and failed sender authentication checks, yet they were accepted because RingCentral was whitelisted in the receiving environment, and they achieved a spam confidence level that let them pass Microsoft’s email filtering entirely.
The Post-Compromise Access: Token Replay and Graph Enumeration
Once a victim clicked through, the attack routed them into a Microsoft AiTM phishing flow that captured MFA-approved tokens, or into the device-code phishing flow. After compromise, the attackers replayed Microsoft 365 tokens from virtual-private-server and commercial VPN infrastructure, then used Microsoft Graph to enumerate Outlook mailboxes, Teams conversations, SharePoint sites, OneDrive files, contacts, calendars, and registered applications, according to ZeroBEC.
Two-Week Persistent Access and the RingCentral Breach Connection
ZeroBEC reported that access persisted for more than two weeks in some cases, giving attackers a sustained window to gather data across the victim’s Microsoft 365 tenant. The researchers noted that RingCentral recently disclosed a data breach claimed by ShinyHunters and that it is possible criminals obtained valid target lists from it, though they drew no firm connection between that breach and this campaign.
What Greatness Means for Microsoft 365 Defenders
The addition of device-code and AiTM flows effectively bypasses the protection that standard multifactor authentication provides, because the attacker steals the same tokens a legitimate user would present and replays them from attacker-controlled infrastructure. That makes token revocation and session review more important than relying on MFA alone to stop account takeover.
The ZeroBEC analysis points to a specific defensive gap: the campaign succeeded in part because blanket domain whitelisting overrode the failures in email authentication. Replacing broad domain exclusions with rules that require valid sender authentication would block emails that fail those checks even from whitelisted domains.
For organizations using Microsoft 365, the practical response is to audit safe-sender lists, prefer authentication-checked email rules over blanket exclusions, hunt for signs of malicious phishing infrastructure, and scrutinize MFA-approved sign-ins that originate from hosting or VPN addresses. If compromise is suspected, revoking access and refresh tokens, reviewing OAuth consent, and auditing Microsoft Graph activity are the immediate containment steps.
The expansion of Greatness reflects a wider trend in phishing-as-a-service, where platforms that once handled a single phishing technique now bundle AiTM, device-code, and token-replay capabilities into a subscription. That packaging lowers the technical bar for attackers and widens the population of actors who can successfully target MFA-protected accounts, making the wholesale review of email authentication and token handling a priority for any organization that depends on a cloud identity platform.
The persistence of the access — more than two weeks in some observed cases — also argues for treating a suspected AiTM compromise as a deeper intrusion than a stolen password alone. Once tokens are replayed and Graph enumeration has mapped a tenant, the attacker has a durable foothold that standard password resets will not remove, which makes rapid token revocation and a full review of consent and access the decisive steps in containing the damage.
