PHISHING SERVICE SPOOFS RINGCENTRAL TO STEAL MICROSOFT 365 ACCOUNTS

Summary from the TLDR InfoSec newsletter

The Greatness phishing platform recently bypassed email filters by spoofing RingCentral voicemail alerts to target organizations that had blanket-whitelisted the domain, despite the lures failing standard SPF, DKIM, and DMARC checks. Once clicked, the attack routed victims through an adversary-in-the-middle (AiTM) flow to steal MFA-approved tokens, allowing attackers to replay them from remote VPNs and stealthily siphon Microsoft 365 data for weeks. To mitigate this threat, defenders must immediately replace broad safe-sender exclusions with strict authentication requirements, hunt for anomalous MFA sign-ins originating from hosting providers, and comprehensively revoke access tokens if a compromise is suspected.