Greatness PhaaS Evades Email Security and MFA to Take Over Microsoft 365 Accounts

Greatness has emerged as a phishing-as-a-service platform designed to steal Microsoft 365 access at a time when many organizations assume multi-factor authentication will stop account takeovers.

Instead of just getting a password, it can take a real sign-in token that allows an attacker to access cloud services as the victim. A recent campaign used fake RingCentral voicemail and performance-review emails to land in inboxes.

The messages did not pass SPF, DKIM, and DMARC checks, but safe-sender lists for the domain ignored these issues. This makes a helpful feature a risk for attackers.

Analysts at ZeroBEC found the activity while looking into four emails sent to a safe organization. ZeroBEC said the campaign used real-time login relays, device-code phishing, and a central operator service through Telegram.

The issue is bigger than just one stolen mailbox. When a token is taken, it can reveal Outlook, Teams, SharePoint, OneDrive, calendars, contacts, and apps, leading to more fraud or phishing in the system. This also shows why we should care about real-time AiTM phishing attacks, even if MFA is used a lot.

Researchers noticed that operators used fake voicemail messages. These messages encouraged people to open a supposed recording or evaluation notice.

The delivery chain starts with pretending to be a trusted brand and may go through many redirects before arriving at a page controlled by an attacker.

It also looks for automated browsers and asks visitors to prove they are human. This layered method can make normal scanning less effective and is similar to methods used in recent MFA bypass campaigns.

At the last step, Greatness works as a live link between the victim and Microsoft 365. The victim sees their organization’s real branding, types in a password, and completes the usual MFA request.

The relay gets the authentication token, so the criminal doesn’t have to bypass MFA directly. That difference is important when dealing with incidents. Just resetting a password might not stop access since old tokens and refresh tokens can still be used.

Investigators need to cancel active sessions in Entra ID, check OAuth application permissions, and search for unknown sign-ins that have already completed MFA, as advised in SharePoint AiTM incident guidance.

Greatness has a way to enter a code, using pages about documents that convince users to input a code and log in for real. This provides operators another way when a live proxy doesn’t work. The platform’s shared backend means that while campaign setups can change, the main operations stay linked.

Organizations need to check all safe-sender lists and transport-rule exclusions, especially for popular software companies. A domain should get special treatment only if its email passes the right authentication checks.

Vendor breach alerts should start the same check. A customer list can show which companies might trust a vendor’s domain, allowing for believable fakes.

Teams can better find issues by checking if the sender, claimed brand, and destination domain match. This pattern is also seen when hacked Outlook accounts share links that steal credentials. Security teams need to look for the domains, proxy addresses, strange Laravel cookies, and quick access to Microsoft 365 services from a new network.