Have I Been Pwned says the RingCentral incident exposed 1.6 million email addresses plus names, phone numbers, and physical addresses, which can make targeted phishing more convincing. Separately, researchers described spoofed RingCentral emails that bypassed defenses due to allowlisting and led victims to Microsoft 365 credential/token theft infrastructure. The article emphasizes that brand-based allowlisting should not override failed email authentication checks.
Have I Been Pwned added a RingCentral related incident to its breach database, reporting that 1.6 million unique email addresses were exposed along with names, phone numbers, and physical addresses. Separately, researchers described a spoofing campaign in which RingCentral branded emails were used to direct victims toward Microsoft 365 credential and token theft infrastructure. RingCentral stated it discovered a sophisticated social engineering campaign and engaged a third-party forensic firm.
Attackers sent RingCentral branded emails prompting recipients to click a link and sign in. These messages failed SPF and DMARC checks and lacked a DKIM signature, which normally would flag them as suspicious. Despite these authentication failures, the messages were accepted by receiving systems because RingCentral had been whitelisted. Clicking the link routed victims to attacker infrastructure, where adversary-in-the-middle or device-code phishing techniques were used to capture Microsoft 365 credentials or session tokens.
The core weakness was not the phishing content itself but a policy gap: brand-based allowlisting overrode the results of standard email authentication checks. When a trusted brand name is whitelisted without regard to SPF, DMARC, or DKIM outcomes, spoofed messages using that brand can slip through even when technical indicators clearly show the message did not originate from the real sender. Separately, the exposed contact data from the breach, including names, phone numbers, and physical addresses, gives attackers material to craft more convincing and personalized phishing attempts referencing RingCentral.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Have I Been Pwned reported 1.6 million unique email addresses were exposed along with names, phone numbers, and physical addresses.
The emails failed SPF and DMARC checks and had no DKIM signature, but receiving systems still accepted them because RingCentral had been whitelisted.
Clicking the lure sent victims to attacker-controlled infrastructure where adversary-in-the-middle or device-code phishing was used to target Microsoft 365 accounts.
Administrators should look for suspicious Microsoft 365 sign-ins from hosting providers or VPN infrastructure and consider revoking access and refresh tokens while reviewing OAuth consent and Microsoft Graph activity.
Imagine a RingCentral email that looks perfect, uses your real phone number, and still leads straight to stolen Microsoft 365 access. After RingCentral’s breach exposed 1.6 million contacts, spoofed RingCentral emails slipped past filters because the brand was whitelisted, even though SPF and DMARC failed and there was no DKIM. Clicking that email’s link sends you through non-Microsoft ‘Greatness’ infrastructure into a fake Microsoft 365 sign-in, where adversary-in-the-middle or device-code phishing quietly grabs your credentials and tokens. Here’s the move: if you see a RingCentral-branded email that leads to Microsoft 365, don’t trust the link, open Microsoft 365 directly from your bookmarks or the app and sign in there instead.
This weekly roundup describes multiple real-world campaigns where attackers trick people using familiar brands and “verification” prompts to steal credentials or install remote-control tools. The common theme is trust abuse: messages and web pages look legitimate, then push users to log in, click…
This article describes real-world “device code phishing” campaigns where victims are tricked into approving an OAuth device login, granting attackers access without stealing passwords. It highlights rapid criminal adoption via phishing-as-a-service kits and notes heavy targeting of Microsoft…
Attackers sent emails that looked like Microsoft Teams/HR notifications and pushed users through Microsoft’s real sign-in and OAuth consent screens. When victims approved the requested permissions, the attackers obtained an authorization token and could access Microsoft 365 data like Outlook,…
Criminals using the “Greatness” phishing-as-a-service kit are running real-world phishing campaigns that trick employees into approving a Microsoft device-code login flow, allowing attackers to bypass MFA and steal access tokens. Recent activity includes RingCentral “voicemail” lures and multi-step…
Google says the BlackFile extortion group (UNC6671) rebranded to “Redact” while keeping the same core scam: phone calls that impersonate IT helpdesk staff and push “urgent security migrations.” Victims are directed to spoofed login pages that steal passwords and MFA codes, enabling attackers to…
Microsoft says a Russia-linked group compromised hotel and conference guest Wi‑Fi sign-in systems to redirect travelers to phishing pages and fake “update” prompts. The goal was to steal credentials (including Microsoft 365) and push malware when devices automatically check connectivity after…
