Criminals using the “Greatness” phishing-as-a-service kit are running real-world phishing campaigns that trick employees into approving a Microsoft device-code login flow, allowing attackers to bypass MFA and steal access tokens. Recent activity includes RingCentral “voicemail” lures and multi-step redirect chains with CAPTCHA and anti-analysis checks, ending at either an adversary-in-the-middle (AiTM) proxy or a device-code endpoint. Once attackers have tokens, they can quickly access Microsoft 365 data (Outlook, Teams, SharePoint, OneDrive) and maintain access for weeks.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You get an email: “New voicemail received (RingCentral), listen to message.” Looks normal, lands right in your inbox. You click. Now it’s a five-step maze: redirects, a CAPTCHA, then a real Microsoft page asking you to enter a short device code to hear the voicemail. This is the Greatness kit using Microsoft’s legit device-code flow. There’s nothing visually wrong. The only clue: you weren’t expecting a device code for a simple voicemail. If you ever see a surprise Microsoft device code prompt, stop. Don’t enter it, report the email or page to Security immediately.
This article describes real-world “device code phishing” campaigns where victims are tricked into approving an OAuth device login, granting attackers access without stealing passwords. It highlights rapid criminal adoption via phishing-as-a-service kits and notes heavy targeting of Microsoft…
Cofense reports multiple real-world campaigns where attackers don’t hack the browser, they trick employees by copying normal browser experiences like login pop-ups, software update prompts, and “verification” checks. The goal is to get users to enter credentials, approve attacker sessions, or run…
A campaign dubbed “TerminalFix” uses compromised websites to display fake Cloudflare CAPTCHA checks that instruct visitors to copy and run a PowerShell command. The goal is to get a user to run attacker-provided commands themselves, which can lead to persistent access and deeper intrusion into the…
Researchers report NovaCookies, a phishing-as-a-service toolkit that steals Microsoft 365 session cookies by proxying real logins in real time. The campaigns abuse genuine DocuSign email notifications to deliver a malicious document link that ultimately leads to an attacker-controlled Microsoft 365…
Have I Been Pwned says the RingCentral incident exposed 1.6 million email addresses plus names, phone numbers, and physical addresses, which can make targeted phishing more convincing. Separately, researchers described spoofed RingCentral emails that bypassed defenses due to allowlisting and led…
A criminal group tracked as UNC6671 called employees while pretending to be their company IT helpdesk, creating urgency around “mandatory” security changes. Victims were directed to lookalike login pages to “enable passkeys” or “update MFA,” allowing attackers to steal passwords and capture…
