This Sneaky Phishing Service Just Got More Dangerous for Microsoft 365 Users

Michael Miller · 2026-08-04

If you've been paying attention to the cybersecurity landscape, you know that phishing attacks are nothing new. But the game just changed, and not in a good way. The Greatness phishing-as-a-service (PhaaS) platform has quietly expanded its arsenal, moving beyond simple credential theft to something far more insidious. We're talking about adversary-in-the-middle (AiTM) attacks and device-code phishing, both specifically engineered to bypass the security measures that protect Microsoft 365 accounts. And here's the kicker: it's all being done through a convincing spoof of RingCentral, a popular business communications tool. That's a clever disguise, and it's working. ### What Exactly Is Greatness? First, let's break down what we're dealing with. Greatness isn't some lone hacker in a basement. It's a sophisticated phishing-as-a-service platform, meaning cybercriminals can rent its tools and infrastructure to launch attacks without needing deep technical skills. Think of it as a subscription service, but for illegal activity. Originally, Greatness was known for its ability to create highly convincing fake login pages. It would harvest Microsoft 365 credentials from unsuspecting victims. But the operators behind it realized that stealing passwords alone isn't enough anymore. Multi-factor authentication (MFA) has become standard practice, and it's a formidable barrier. So, they adapted. ### The Shift to Adversary-in-the-Middle Attacks The new wave of attacks leverages AiTM techniques. Instead of just tricking you into entering your password on a fake page, the attacker positions themselves right in the middle of your session. Here's how it works in simple terms: - You receive an email that looks like it's from RingCentral, perhaps about a missed call or a voicemail. - You click the link, and it takes you to what appears to be a legitimate RingCentral sign-in page. - You enter your Microsoft 365 credentials and even complete the MFA prompt. - The attacker, sitting in the middle, captures your session cookie. That session cookie is the golden ticket. It allows the attacker to bypass MFA entirely because, to the system, they now have an authenticated session. They don't need your password anymore; they have your identity. ### The Danger of Device-Code Phishing Greatness has also added device-code phishing to its toolkit. This is a sneaky trick that exploits how some applications authenticate on devices like smart TVs, game consoles, or even certain mobile apps. Instead of entering a username and password, you're given a code to enter on another device. The attacker generates a legitimate device-code request from Microsoft and tricks you into entering that code on a malicious site. Once you do, they receive the authentication token, again bypassing MFA. It's a low-effort, high-reward strategy that's proving to be incredibly effective. ### Why RingCentral Spoofing Is So Effective Let's talk about the disguise. RingCentral is widely used across businesses in the United States, making it a perfect lure. People are used to getting notifications from it. A missed call alert or a new voicemail is a common, everyday occurrence. It doesn't raise red flags. > "The most dangerous phishing attacks are the ones that look completely normal. They exploit our trust in the tools we use every day." This is a classic social engineering tactic. By impersonating a trusted brand, the attackers lower your guard. You're not thinking about security; you're thinking about that important call you might have missed. ### How to Protect Yourself and Your Business So, what can you do? The first line of defense is awareness. If you receive an unexpected email from RingCentral, or any service, urging you to log in, be skeptical. Hover over the link to see the actual URL before clicking. If it looks off, it probably is. Here are a few practical steps to keep your Microsoft 365 account safe: - **Enable Conditional Access policies** in Azure AD to restrict access based on location, device, and risk level. - **Use phishing-resistant MFA methods**, like FIDO2 security keys, which are much harder to bypass than standard text-message codes. - **Train your employees regularly** on how to spot phishing attempts, especially those that impersonate internal tools. - **Monitor your sign-in logs** for unusual activity, such as logins from new locations or devices. ### The Bottom Line The evolution of Greatness is a stark reminder that cybersecurity is a moving target. Attackers are constantly refining their methods, and the tools they use are becoming more accessible. The days of spotting a phishing email by its poor grammar and sketchy links are fading fast. We need to stay vigilant, not just for ourselves but for our entire organization. The next time you get a notification that seems slightly off, trust your gut. It might just be the thing that saves your data. Stay safe out there, and keep your defenses up.