Greatness Phishing Kit Spoofs RingCentral to Steal M365

The emails failed every authentication check. SPF said forged. DMARC said forged. There was no DKIM signature at all. They landed in the inbox anyway, because the organizations being attacked had told Microsoft to trust RingCentral no matter what, and the attackers were claiming to be RingCentral. Email security firm ZeroBEC documented the campaign, run through the Greatness phishing platform, and the finding is uncomfortable: the defense that failed was not SPF or DMARC. Those worked. It was the allowlist sitting above them.

Key Takeaways

• ZeroBEC documented a Greatness phishing campaign spoofing service@ringcentral[.]com that reached inboxes despite failing SPF and DMARC, because recipient organizations had allowlisted the RingCentral domain.
• The messages hit a Microsoft Exchange Spam Confidence Level of -1, the value that marks a message as trusted and skips normal spam filtering.
• Greatness sells for $289 per month on a Telegram channel with more than 3,250 subscribers, up from $120 per month in January 2024.
• Attackers captured MFA approved session tokens through adversary in the middle and device code phishing, then replayed them from VPS and commercial VPN infrastructure, holding access for more than two weeks in some cases.
• Post compromise, the operators enumerated Outlook mailboxes, Teams conversations, SharePoint sites, OneDrive files, contacts, calendars and registered applications through Microsoft Graph.

What Is the Greatness Phishing Kit?

Greatness is a phishing as a service platform that has targeted Microsoft 365 accounts since mid 2022, and it has quietly become one of the better funded operations in the category. Subscribers pay $289 a month over Telegram, about $9.60 a day, for an operator panel that supports three separate credential theft paths from shared backend infrastructure: adversary in the middle credential and token capture, device code phishing, and OAuth consent abuse. The Hacker News reported the kit ships with more than 11 lure templates, including Voicemail, OneDrive, QR and AudioLogin variants, plus prebuilt HTML, PDF redirectors and SVG files.

Targets span the United States, Canada, the UK, Australia and South Africa. Microsoft 365 is the headline product, but Greatness also runs against iCloud, Yahoo and Google Workspace users, which means the same operator panel covers most of the corporate and consumer email market.

The price history tells you the market is healthy. A 141% subscription increase in roughly two years is not what a declining product does.

How Did the Emails Get Through SPF and DMARC?

They did not get through. They were caught, and then waved in anyway by a rule that outranked the verdict. The mail originated from an unauthorized IONOS mail server while claiming to be service@ringcentral[.]com. SPF failed. DMARC failed. No DKIM signature existed. Every authentication layer produced the correct answer.

What overrode it was the recipient organizations' safe sender configuration. Because these companies were genuine RingCentral customers, someone had added the domain to an allowlist so vendor notifications would stop landing in junk. Microsoft's documentation is direct about the consequence: entries on these lists produce a Spam Confidence Level of -1, and using them "creates a high risk of attackers successfully delivering email to the Inbox that would otherwise be filtered."

SCL -1 is not a scoring nudge. It is a declaration that the message is trusted and should skip spam filtering stages entirely. There is a meaningful distinction inside that, and it matters for anyone auditing a tenant. A user level Safe Senders entry in Outlook still allows malware and high confidence phishing to be filtered. A tenant level mail flow rule that sets SCL to -1, or an IP Allow List entry, bypasses far more. Microsoft's own guidance says such a rule should never key on the sender domain alone, yet keying on the sender domain alone is exactly how most vendor allowlists get built.

The inversion is the story. Being a paying RingCentral customer is what made an organization vulnerable. That population became far easier to enumerate this month, when a breach exposed 1.6 million RingCentral accounts with names, work email addresses and phone numbers attached. A company with no RingCentral relationship would have seen these messages fail authentication and drop.

The Fake Verified Sender Banner

On top of the technical bypass, the operators stacked a social engineering layer: the messages carried a fraudulent verification banner falsely claiming the sender had been validated. The lures themselves were routine, a fake voicemail notification and a fake performance review notice, but the banner does specific work. It preempts the exact suspicion a trained employee is supposed to feel.

Security awareness programs teach people to look for signals of legitimacy. This campaign manufactured one and printed it in the message body. Worth noting for context: ShinyHunters claimed a breach of RingCentral itself on July 27, 2026, days before this campaign was documented. No researcher has connected the two events, and the claim was not independently corroborated. But ZeroBEC's advice to audit exclusion rules after a vendor breach reads differently against that timeline.

Why Didn't MFA Stop the Attack?

Because MFA was never the thing being bypassed. The victims completed it correctly, and the attacker took what came out the other side. In the adversary in the middle path, the phishing page proxies the real Microsoft login. The user authenticates, satisfies the MFA challenge, and Microsoft issues a valid session token. The proxy keeps a copy.

The device code path is stranger and harder to detect. It abuses the OAuth 2.0 Device Authorization Grant defined in RFC 8628, a legitimate flow built for devices with no keyboard. The attacker generates a code, the victim enters it on the genuine microsoft.com/devicelogin page, and the tokens land in the attacker's hands. No password is ever typed into a fake page. Greatness is now at least the fourth kit to add this capability that we have covered in 2026, after EvilTokens, Kali365 and DEBULL, a technique that was novel in April and is now standard inventory.

Then comes the part most incident responders learn the hard way. Resetting the password does not evict the attacker. Microsoft Entra documentation confirms that a password reset does not automatically invalidate existing sessions; an administrator must explicitly revoke sessions. Even then, already issued access tokens stay valid until expiry, and Microsoft assigns them a randomized 60 to 90 minute lifetime. Refresh tokens run 90 days by default. That is the arithmetic behind two weeks of undetected access.

What This Means for Your Inbox

A stolen mailbox is not one message. It is every message you have ever sent or received, including the ones you would never forward. ZeroBEC observed the operators enumerating Outlook mailboxes, Teams conversations, SharePoint sites, OneDrive files, contacts, calendars and registered applications through Microsoft Graph, but mailbox access is the highest value item on that list, because it contains the reset links, the invoices, the legal threads and the organizational chart that make every subsequent attack easier.

It also enables the next round of phishing from inside the trusted perimeter, which is the same problem AiTM operators exploit in hijacked Outlook accounts. Mail from a colleague's real account passes every authentication check honestly, which is exactly the pattern Gen Digital documented in its H1 2026 attack chains.

What to Do Right Now

• Audit every safe sender list, IP Allow List entry and mail flow rule in your tenant. Delete blanket domain exclusions. If a vendor's mail needs help arriving, condition the rule on authentication results, not the sender domain alone.
• Block the device code authentication flow globally with a Conditional Access policy unless a documented business case requires it.
• Enforce SPF, DKIM and DMARC on your own domain, and stop overriding the verdicts on inbound mail.
• Hunt for MFA approved sign ins originating from hosting provider and commercial VPN ASNs. That combination is the token replay signature.
• On suspected compromise, revoke all access and refresh tokens explicitly, review OAuth consent grants, audit Microsoft Graph activity, and check Microsoft 365 service access logs. A password reset alone accomplishes nothing.
• Move toward phishing resistant MFA. FIDO2 and certificate based authentication break the adversary in the middle proxy in a way that push notifications and one time codes do not.

Allowlists are technical debt that accrues silently. Someone added that RingCentral entry to solve a real problem on a real Tuesday, and it worked for years. The bill arrived when an attacker with a $289 subscription figured out which vendors your company already trusts.