Identity & Phishing-as-a-Service Threat: "Greatness" PhaaS Targets Microsoft 365 via RingCentral Exploitation & AiTM Session Theft
Executive Summary
A major threat intelligence report published on August 25–26, 2026, by Kaseya Threat Research and cybersecurity monitoring agencies details an aggressive, widespread enterprise campaign operated by the "Greatness" Phishing-as-a-Service (PhaaS) syndicate. Subscribed to by hundreds of cybercrime affiliates for under $300 per month, Greatness has upgraded its tooling to execute advanced Adversary-in-the-Middle (AiTM) reverse-proxy attacks and OAuth device-code phishing specifically targeting corporate Microsoft 365 (M365) accounts. In recent high-volume campaigns, threat actors exploited trust relationships by spoofing RingCentral communications (service@ringcentral[.]com), bypassing email gateway spam filters due to vendor whitelisting, and stealing authenticated session cookies to defeat multi-factor authentication (MFA).
Deep-Dive Technical Analysis of the Greatness PhaaS Campaign
The attack chain illustrates the increasing sophistication of turnkey phishing infrastructure:
1. Whitelist Abuse & RingCentral Email Gateway Evasion
Threat actors bypass modern email security gateways (SEG) by leveraging business-communication trust assumptions:
* Spoofed RingCentral Communications: Phishing emails are disguised as official RingCentral voicemail notifications, missed call recordings, or urgent corporate performance review alerts.
* Authentication Header Failures Bypassed: Although the emails originate from unauthorized IONOS mail servers—failing SPF and DMARC verification and lacking valid DKIM signatures—receiving mail servers accept and deliver the messages because ringcentral.com domains are frequently hard-whitelisted in tenant spam configurations.
* Deceptive Verification Banners: The emails include embedded HTML banners falsely asserting that the sender has been "Verified by your organization's secure email gateway," lowering employee suspicion.
2. AiTM Reverse-Proxy Session Cookie Harvesting & Device-Code Flows
Once a victim clicks the notification lure, Greatness executes real-time session theft:
* Dynamic AiTM Reverse Proxy: The user is routed to a custom-branded login portal that mirrors the victim organization's Microsoft Entra ID (Azure AD) branding. As the user enters their credentials and completes push-based MFA, the Greatness proxy server relays the inputs to Microsoft in real time and intercepts the resulting authenticated session cookie (ESTSAUTH, ESTSAUTHPERSISTENT).
* OAuth Device-Code Abuse: Alternatively, Greatness prompts users to enter an authorization device code under the guise of connecting an email application, abusing legitimate OAuth 2.0 device authorization flows to generate persistent access and refresh tokens that bypass passkeys and conditional access policies.
Campaign Attribute
Threat Intelligence Details
Threat Infrastructure
Greatness Phishing-as-a-Service (PhaaS)
Targeted Platform
Microsoft 365 / Microsoft Entra ID Enterprise Tenants
Primary Lure
Spoofed RingCentral Voicemail & HR Performance Alerts
Attack Methodologies
Adversary-in-the-Middle (AiTM) Reverse Proxy & OAuth Device-Code Phishing
Bypass Capabilities
Defeats SMS OTP, Mobile Authenticator App Push MFA, and IP Geolocation Rules
Monetization
Subscription-Based Telegram Bot Distribution (~$300/month)
The Collapse of Legacy MFA Against Reverse-Proxy Phishing
The rapid adoption of PhaaS platforms like Greatness demonstrates that traditional multi-factor authentication methods (such as SMS codes, email verification, and mobile app push approvals) are fundamentally vulnerable to reverse-proxy interception. When an AiTM proxy acts as a transparent intermediary, whatever credential or second factor the user provides is instantly mirrored to the genuine authentication server.
Organizations must accelerate the rollout of phishing-resistant authentication mechanisms that cryptographically bind credentials to specific domain origins.
Recommendations and Mitigations
CISOs, identity administrators, and security operations teams should deploy the following defensive countermeasures:
1. Enforce Phishing-Resistant Authentication (FIDO2 / Passkeys): Transition all Microsoft 365 users to FIDO2 WebAuthn security keys or Certificate-Based Authentication (CBA), which mathematically bind authentication to the legitimate login URL and prevent reverse-proxy theft.
2. Restrict or Disable OAuth Device-Code Flow: Block the OAuth 2.0 device authorization grant (device_code) across Microsoft Entra ID for non-managed, non-compliant endpoints.
3. Audit Email Whitelists & Enforce Strict DMARC Rejection: Eliminate domain-level whitelisting for third-party communication tools (e.g., RingCentral, Zoom, DocuSign); enforce strict DMARC p=reject policies on all incoming mail.
4. Implement Continuous Token Binding & Conditional Access: Enforce Microsoft Entra Token Protection and Conditional Access policies that bind session tokens to compliant device IDs and revoke sessions upon anomalous IP/ASN changes.