TLDR Tech / InfoSec
Phishing service spoofs RingCentral to steal Microsoft 365 accounts
The Greatness phishing platform recently bypassed email filters by spoofing RingCentral voicemail alerts to target organizations that had blanket-whitelisted the domain, despite the lures failing standard SPF, DKIM, and DMARC checks. Once clicked, the attack routed victims through an adversary-in-the-middle (AiTM) flow to steal MFA-approved tokens, allowing attackers to replay them from remote VPNs and stealthily siphon Microsoft 365 data for weeks. To mitigate this threat, defenders must immediately replace broad safe-sender exclusions with strict authentication requirements, hunt for anomalous MFA sign-ins originating from hosting providers, and comprehensively revoke access tokens if a compromise is suspected.
Read the full story