Greatness Phishing-as-a-Service Expands Scope, Exploits Safe Sender Misconfigurations for Persistent M365 Access
A sophisticated phishing-as-a-service (PhaaS) platform called Greatness is enabling threat actors to maintain multi-factor authentication (MFA)-approved access to Microsoft 365 tenants for over two weeks after the initial compromise primarily through stolen authentication tokens rather than password theft. First documented by Cisco Talos in May 2023, the platform has since expanded its targeting beyond Microsoft 365 to include iCloud, Yahoo, and Google Workspace, while remaining focused on enterprise M365 environments.
How Greatness Operates
Greatness is a fully monetized service, available via Telegram through a bot and a public channel with 3,220 subscribers, offering a $289/month subscription undercutting competitors like Forg365 ($400/month). Operators register via the bot, receive trial licenses, and are provisioned with phishing infrastructure using api-[token].[base-domain] conventions.
The platform provides a web-based "O365 Panel" that tracks campaign metrics, including:
- Total cookies and accounts compromised
- Visit counts and geospatial victim mapping
- License days remaining
- Blocked bots
- 11+ downloadable lure templates (voicemail, OneDrive, QR codes, Windows Explorer themes)
Exploiting Trust: The RingCentral Campaign
A recent campaign targeted a RingCentral customer protected by ZeroBEC, using spoofed voicemail lures sent from service@ringcentral[.]com via IONOS infrastructure. Despite failing SPF, DKIM, and DMARC checks, the emails bypassed security due to misconfigured domain-based safe sender exclusions a setting that trusted any email claiming to be from ringcentral[.]com, regardless of authentication.
Attackers weaponized this trust by adding a fraudulent banner:
"This sender has been verified by [organization].com safe senders list"
The strategic choice of RingCentral is notable it is widely deployed, commonly whitelisted, and recently suffered a ransomware incident, raising concerns about customer data exposure. This tactic extends beyond RingCentral: any breach exposing customer lists could reveal organizations likely to trust vendor domains unconditionally, making them vulnerable to similar attacks.
Technical Execution: AiTM & Token Persistence
Victims clicking the "Open Message" button are routed through a five-stage chain:
- Legitimate click-tracking service (e.g., searchbriefing[.]com)
- Anti-analysis redirector (finreportviewersoftware[.]sbs) using hex/ROT13/base64 obfuscation
- Greatness API endpoint for bot detection
- Cloudflare Turnstile-style "Security Verification" gate
- Final AiTM proxy or device code phishing flow
The AiTM branch relays live Microsoft sign-ins, capturing MFA-approved tokens, then redirects victims to legitimate sites (e.g., raymondjames[.]com) to avoid suspicion. The device code branch abuses OAuth device authorization, using a DocuSign-themed lure and a JavaScript polling function to interact with the Greatness admin backend (greatwallwebsite[.]blog/admin/apifiles[.]php).
Infrastructure & Persistence
Greatness operates a centralized backend, with tokens issued for one domain (e.g., nawarra[.]top) accepted across others (xdccoc[.]top, onewayoutolook[.]one), proving unified license validation. All phishing domains are Cloudflare-fronted, hosted on PHP 8.2.12 Laravel, with wildcard DNS and consistent JSON error responses upon license expiration.
Post-compromise, attackers operationalize stolen tokens via commercial VPN infrastructure, including:
- Limestone Networks VPS (38.248.95[.]214, fronted as gen-vpn[.]com)
- ExpressVPN, EventVPN/Netshield, and PIA VPN exit nodes
- Systematic Microsoft 365 enumeration via Graph API (Outlook, Teams, SharePoint, OneDrive, calendars, contacts, and registered apps)
The most alarming finding: tokens remained valid for over two weeks, allowing persistent access even without Conditional Access policies in place. The root cause was a dual failure:
- Safe sender exclusions that delivered the phish
- Identity-layer controls that focused on credential rotation rather than token and refresh token revocation
Detection & Attribution
Greatness activity is tracked under the honeystorm tag, with URLQuery documenting over 50 campaigns since April 2026. Security firms like Sekoia provide built-in detection rules, while CISA, Cisco Talos, Hornet Security, Trellix, and HALOCK have published research linking "HoneyStorm" to Greatness.
Defenders are advised to monitor for:
- Infrastructure fingerprints (e.g., "just a momment" redirectors, PHP 8.2.12 Cloudflare domains)
- VPN-hosted proxy IP ranges (e.g., 46.173.240[.]0/24, 158.173.166[.]0/24)
- Vendor-based safe sender misconfigurations that bypass authentication checks
The platform’s evolution underscores the growing threat of AiTM PhaaS ecosystems, where token replay not password theft drives persistence, making traditional security measures insufficient.
Source: https://gbhackers.com/stolen-greatness-authentication-tokens/
Yahoo TPRM report: https://www.rankiteo.com/company/yahoo
Google TPRM report: https://www.rankiteo.com/company/google
"id": "gooyah1785939913",
"linkid": "google, yahoo",
"type": "Cyber Attack",
"date": "4/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'name': 'RingCentral customer (specific name '
'undisclosed)',
'type': 'Enterprise'}],
'attack_vector': ['Stolen authentication tokens',
'AiTM (Adversary-in-the-Middle) proxy',
'Device code phishing',
'Spoofed vendor emails (e.g., RingCentral)'],
'data_breach': {'personally_identifiable_information': 'Potential (depends on '
'tenant data)',
'sensitivity_of_data': 'High (enterprise communications, '
'documents, and application data)',
'type_of_data_compromised': ['Authentication tokens',
'Microsoft 365 tenant data']},
'date_publicly_disclosed': '2023-05',
'description': 'A sophisticated phishing-as-a-service (PhaaS) platform called '
'Greatness is enabling threat actors to maintain multi-factor '
'authentication (MFA)-approved access to Microsoft 365 tenants '
'for over two weeks after the initial compromise primarily '
'through stolen authentication tokens rather than password '
'theft. The platform has expanded its targeting beyond '
'Microsoft 365 to include iCloud, Yahoo, and Google Workspace, '
'while remaining focused on enterprise M365 environments. The '
'attack exploits misconfigured domain-based safe sender '
'exclusions to bypass security controls.',
'impact': {'brand_reputation_impact': 'Potential reputational damage due to '
'vendor domain spoofing (e.g., '
'RingCentral)',
'data_compromised': ['Microsoft 365 tenant data (Outlook, Teams, '
'SharePoint, OneDrive, calendars, contacts, '
'registered apps)',
'Authentication tokens'],
'identity_theft_risk': 'High (stolen authentication tokens and PII '
'exposure)',
'operational_impact': 'Persistent unauthorized access to '
'enterprise environments for over two weeks',
'systems_affected': ['Microsoft 365',
'iCloud',
'Yahoo',
'Google Workspace']},
'initial_access_broker': {'backdoors_established': ['Stolen authentication '
'tokens',
'Persistent M365 access'],
'entry_point': ['Spoofed vendor emails (e.g., '
'RingCentral)',
'Phishing lures (voicemail, '
'OneDrive, QR codes)'],
'high_value_targets': 'Enterprise Microsoft 365 '
'tenants'},
'investigation_status': 'Ongoing (documented since May 2023)',
'lessons_learned': 'The incident highlights the risks of misconfigured safe '
'sender exclusions and the need for token revocation '
'controls in addition to credential rotation. Persistent '
'access via stolen tokens underscores the limitations of '
'traditional security measures against AiTM attacks.',
'motivation': ['Financial gain',
'Persistent access to enterprise environments'],
'post_incident_analysis': {'corrective_actions': ['Token and refresh token '
'revocation',
'Enforcement of Conditional '
'Access policies',
'Review and correction of '
'safe sender '
'configurations'],
'root_causes': ['Misconfigured domain-based safe '
'sender exclusions',
'Lack of token revocation controls',
'Over-reliance on credential '
'rotation without token '
'management']},
'recommendations': ['Review and correct safe sender configurations to ensure '
'authentication checks are enforced',
'Implement Conditional Access policies to limit token '
'validity periods',
'Monitor for infrastructure fingerprints associated with '
'Greatness (e.g., PHP 8.2.12 Cloudflare domains, '
'VPN-hosted proxy IPs)',
'Revise incident response plans to include token '
'revocation as a priority',
'Educate employees on the risks of vendor domain spoofing '
'and AiTM attacks'],
'references': [{'source': 'Cisco Talos'},
{'source': 'Sekoia'},
{'source': 'CISA'},
{'source': 'Hornet Security'},
{'source': 'Trellix'},
{'source': 'HALOCK'},
{'source': 'URLQuery (honeystorm tag)'}],
'response': {'enhanced_monitoring': ['Monitor for infrastructure fingerprints '
'(e.g., PHP 8.2.12 Cloudflare domains)',
'Track VPN-hosted proxy IP ranges'],
'remediation_measures': ['Token and refresh token revocation',
'Review and correct safe sender '
'configurations',
'Enforce Conditional Access policies']},
'threat_actor': 'Greatness PhaaS operators (HoneyStorm tag)',
'title': 'Greatness Phishing-as-a-Service Expands Scope, Exploits Safe Sender '
'Misconfigurations for Persistent M365 Access',
'type': 'Phishing-as-a-Service (PhaaS)',
'vulnerability_exploited': ['Misconfigured domain-based safe sender '
'exclusions',
'OAuth device authorization abuse',
'Lack of token revocation controls']}