The Greatness phishing-as-a-service (PhaaS) platform — sold for $289 per month over Telegram — has been running a campaign that spoofs RingCentral, the cloud calling and messaging platform used by businesses across the US, UK, Canada, Australia, and South Africa. Attackers send fake voicemail and performance-review notifications that claim to originate from service@ringcentral.com. Even though the messages fail SPF and DMARC checks and carry no DKIM signature, they are still delivered because many Microsoft Exchange environments whitelist the RingCentral domain in their safe-sender lists. Exchange assigns these emails a Spam Confidence Level of -1, bypassing the normal filtering stages entirely. The campaign was documented by email security researchers at ZeroBEC and reported by BleepingComputer.
Once a recipient clicks the embedded button, Greatness routes them through one of two attack flows: an adversary-in-the-middle proxy that captures a live, MFA-approved Microsoft 365 session token, or a device-code phishing flow that tricks the victim into authorizing a persistent OAuth grant. Post-compromise, attackers replay the stolen tokens from VPS and commercial VPN infrastructure and use Microsoft Graph to enumerate Outlook mailboxes, Teams conversations, SharePoint sites, OneDrive files, contacts, calendars, and registered OAuth applications. In observed cases, access persisted for more than two weeks. ZeroBEC notes that the attacker likely sourced their target list from RingCentral’s own data breach disclosed July 28, 2026 and claimed by threat actor ShinyHunters, which exposed data for a subset of RingCentral customers.
How to check if you’re affected
Affected products are Microsoft 365, iCloud, Yahoo, and Google Workspace accounts targeted by Greatness campaigns. To audit your Microsoft 365 environment: review the Entra ID (Azure AD) sign-in logs for MFA-approved authentications originating from hosting or VPN IP ranges you do not recognize; look for device-code flows in your audit log; and check your Exchange safe-sender list for blanket @ringcentral.com domain exemptions that bypass authentication checks. If tokens were stolen, revoke all active access and refresh tokens for affected accounts, review OAuth consent grants, and audit Microsoft Graph activity for unusual enumeration of mailboxes or Teams conversations. Administrators should replace blanket domain exclusions in their safe-sender lists with rules that require valid DKIM, SPF, and DMARC alignment before delivery.