As reported by BleepingComputer, the Greatness phishing-as-a-service (PhaaS) platform has significantly matured its attack capabilities, moving well beyond static credential-harvesting pages into techniques that actively defeat multi-factor authentication. This evolution deserves serious attention from every security team protecting Microsoft 365 tenants.

Threat Alert: As reported by BleepingComputer, the Greatness phishing-as-a-service (PhaaS) platform has significantly matured its attack capabilities, moving well beyond static credential-harvesting pages into techniques that actively defeat multi-factor authentication.

Why This Evolution Is a Threat Inflection Point

The transition from traditional credential phishing to adversary-in-the-middle (AiTM) and device-code phishing is not incremental — it represents a fundamental shift in attacker capability. Legacy MFA controls, particularly TOTP-based authenticator apps and SMS codes, offer no meaningful protection against AiTM proxies. The attacker relays authentication in real time, harvesting session cookies that remain valid long after the victim has closed their browser. Organizations that believed MFA was their safety net are now exposed.

Device-code phishing compounds the problem. By abusing Microsoft's OAuth device authorization flow — a legitimate mechanism designed for input-constrained devices like smart TVs — attackers trick users into authorizing persistent access tokens. These tokens can survive password resets, MFA changes, and even conditional access policy updates if not explicitly revoked. The attacker ends up with a persistent foothold that looks, from Microsoft's perspective, like a legitimately authorized application.

The RingCentral Lure: Why Trusted Brand Spoofing Works

The choice of RingCentral as a spoofed sender is tactically sound. Unified communications platforms are deeply embedded in enterprise workflows — employees receive notifications, voicemail alerts, and meeting invites from these services constantly. The urgency embedded in a "missed call" or "voicemail waiting" notification is a powerful psychological trigger. Security awareness training that focuses on generic phishing indicators often fails when the pretext is this contextually plausible.

Shield53 Perspective: The commoditization of AiTM infrastructure through PhaaS platforms like Greatness means that sophisticated session-hijacking attacks are no longer the exclusive domain of nation-state actors. Any low-skill threat actor with a subscription can now bypass MFA at scale.

Who Is Most at Risk

The RingCentral Lure: Why Trusted Brand Spoofing Works
Mid-market enterprises relying solely on per-user MFA without conditional access policies
Organizations using legacy authentication protocols that haven't enforced modern auth requirements
Teams with high RingCentral or UCaaS usage — the lure is maximally effective where the brand is familiar
IT and finance departments, which are disproportionately targeted due to their access to sensitive systems and wire transfer authority
Companies without SIEM alerting on anomalous OAuth app consent or device-code flow activity

What Makes Detection Hard

AiTM attacks leave subtle forensic traces — sign-in events from the proxy's IP rather than the user's known location, token issuances to unfamiliar client IDs, and session activity from unexpected geographies or ASNs. Without robust sign-in log monitoring and behavioral baselines, these events blend into normal Microsoft 365 authentication noise. Device-code grants are even stealthier: they appear as legitimate OAuth authorizations and may not trigger risk-based conditional access policies at all.

Shield53 Recommendations

Immediate Actions

  • Enforce phishing-resistant MFA — Deploy FIDO2 hardware security keys (e.g., YubiKey) or Windows Hello for Business. These are immune to AiTM relay attacks because the cryptographic response is bound to the legitimate origin domain.
  • Block device-code flow for end users — Use Conditional Access Authentication Strengths or authentication flow policies in Microsoft Entra ID to restrict or block the device authorization grant type for non-approved scenarios.
  • Enable Continuous Access Evaluation (CAE) — CAE allows Microsoft 365 to revoke sessions in near real-time when anomalous signals are detected, reducing the window of stolen-cookie abuse.
  • Audit OAuth app consents — Review all enterprise application registrations and user-granted OAuth consents in Entra ID. Revoke any unrecognized or suspicious app permissions immediately.
  • Configure token lifetime policies — Shorten refresh token lifetimes for high-risk roles to limit the value of stolen tokens.

Detection Guidance

  • Alert on DeviceCodeFlow authentication events in Microsoft Entra sign-in logs, particularly from users who are not expected to use this flow.
  • Monitor for sign-ins immediately followed by OAuth consent grants — a classic AiTM post-compromise pattern.
  • Flag sign-in events where the IP ASN is associated with known proxy or hosting infrastructure.
  • Deploy Microsoft Defender for Cloud Apps or a CASB solution to detect impossible travel and anomalous session behavior post-authentication.

Strategic Posture

Organizations should treat any MFA implementation that isn't phishing-resistant as a temporary, partial control — not a solved problem. The Microsoft 365 ecosystem is the highest-value target in enterprise computing today, and the PhaaS market has industrialized the tools to attack it. Investment in Zero Trust architecture, including device compliance checks as a condition of access, significantly raises the cost for attackers even when credentials and session tokens are compromised.