A phishing kit called Greatness costs $289 a month. Anyone with a Telegram account and that much cash can rent it. Thousands already have.
Its latest trick borrows RingCentral’s name. Fake voicemail and performance-review emails are dressed up to look like they came from the real service. They’re landing in Microsoft 365 inboxes across five countries. Email filters are letting them through.
What is Greatness? A phishing-as-a-service platform active since mid-2022, sold for $289 a month over Telegram. It gives buyers ready-made phishing pages and infrastructure built to steal Microsoft 365 credentials and session tokens. No coding required.
An Email That Passes Every Check And Still Gets Through
The lure emails claim to come from service@ringcentral.com. They don’t. They actually originate from IONOS mail servers, nowhere near RingCentral’s real infrastructure.
Run the standard checks and the email fails every one. SPF fails. DMARC fails. There’s no DKIM signature at all. By every normal measure, this should land in spam.
It doesn’t. Microsoft Exchange assigns the message a Spam Confidence Level of -1, the lowest possible score. That means the system treats it as unquestionably legitimate. RingCentral’s own reputation as a trusted sender appears to override the failed checks. The email even includes a fake banner claiming the recipient’s own safe-sender list verified it.
Two Ways To Get Past MFA
Clicking the email’s button routes victims to Greatness’s own infrastructure. From there, the kit uses one of two techniques.
The first is adversary-in-the-middle phishing. It sits between the victim and the real Microsoft login page. The moment MFA approval goes through, it captures the session token. The second is device-code phishing. It abuses a legitimate OAuth sign-in flow built for devices without a keyboard. Victims end up approving a login on the attacker’s behalf without realizing it. Neither one needs to guess a password. Both walk straight past MFA instead of trying to break it.
That second technique has been spreading fast. Device-code phishing rose an estimated 1,500% during 2026. Vishing attacks aiming for the same MFA gap roughly doubled over the same stretch. Greatness picked up device-code phishing as a feature only recently. It’s riding a trend, not starting one.
Two Weeks Inside A Mailbox
Once a token gets stolen, attackers move fast. Compromised credentials get replayed within minutes. The traffic gets routed through VPS and commercial VPN infrastructure to mask where the login is really coming from.
From there, the account gets picked apart. Outlook, Teams, SharePoint, OneDrive, contacts, calendars, and any registered applications all get pulled into scope. Every bit of it gets enumerated through the Microsoft Graph API. In some cases, that access lasted over two weeks before anyone noticed.
One detail is worth watching, even though it’s unconfirmed. RingCentral itself disclosed a breach in July, claimed by the ShinyHunters extortion group. Whether that breach and this campaign are connected hasn’t been established. The timing is close enough to raise the question.
Conclusion: The Sign-In Was Real. The Session Was Stolen.
Greatness does not need to defeat Microsoft authentication. It turns the legitimate sign-in process into the attack path.
The campaign begins with a RingCentral-themed voicemail or performance-review lure. Sender authentication can fail, yet an unsafe allowlist or trusted-sender exception may still help the message reach the inbox. The victim is then routed through an adversary-in-the-middle proxy or a device-code phishing flow.
The password can be correct. The MFA approval can be genuine. The resulting session can still belong to the attacker.
This is not simply credential theft. It is the theft of authenticated access.
Why This Threat Matters
Each stage borrows trust from a legitimate system.
- A recognized business brand makes the message appear routine.
- An allowlist can weaken the value of failed SPF, DKIM, and DMARC checks.
- AiTM infrastructure can capture a session after MFA succeeds.
- Device-code phishing can use a genuine Microsoft approval page.
- Token replay can remove the need for another interactive login.
- A valid session can expose Outlook, Teams, SharePoint, OneDrive, and other Microsoft 365 resources.
- Graph API activity may allow broad access without producing a conventional failed-login signal.
- PhaaS platforms turn advanced identity compromise into a repeatable service for lower-skilled operators.
The decisive failure is not that MFA was absent. MFA completed successfully. The failure is that the authenticated session was issued into an attacker-controlled flow.
Where Defensive Control Must Operate
This is an identity-first attack. Unknown code does not need to execute on the endpoint for the Microsoft 365 account to be compromised.
Xcitium ITDR helps identify abnormal session reuse, unfamiliar access infrastructure, suspicious non-interactive sign-ins, unusual Graph API activity, and post-authentication behavior that no longer matches the legitimate user.
The human layer also remains important. Xcitium Cyber Awareness Education and Phishing Simulation can train users to recognize fake voicemail notifications, unexpected device-code requests, forged trusted-sender cues, and MFA prompts they did not initiate.
Execution Governance is not the primary control for the original session theft. It becomes relevant only if the attacker later introduces scripts, remote tools, loaders, or other unknown execution onto managed endpoints.
