GoKawiilThe Greatness phishing-as-a-service (PhaaS) platform has expanded from credential phishing to adversary-in-the-middle attacks and device-code phishing targeting Microsoft 365 accounts.
The platform has been active since at least mid-2022, targeting Microsoft 365 users in the United States, Canada, the UK, Australia, and South Africa.
It evolved over the years and now targets multiple platforms, including Microsoft 365, iCloud, Yahoo, and Google Workspace.
Currently, it is sold for $289 per month to cybercriminals over a Telegram channel with thousands of subscribers.
The Greatness panel
Source: ZeroBEC
In a recent campaign observed by researchers at email security company ZeroBEC, Greatness operators abused the RingCentral communications platform to bypass email security filters on the recipient side.
RingCentral is a communications platform used by businesses for services such as cloud calling, messaging, and voicemail.
In the Greatness phishing activity, the attacker impersonated the platform by claiming their emails came from service@ringcentral[.]com, targeting actual users of the service.
These emails used fake voicemail and performance-review notifications as lures to entice recipients to open them.
... continue reading