Full Report
The Greatness phishing-as-a-service (PhaaS) platform has expanded from credential phishing to adversary-in-the-middle attacks and device-code phishing targeting Microsoft 365 accounts. [...]
Analysis Summary
This report summarizes the evolution and recent activity of the Greatness Phishing-as-a-Service (PhaaS) platform based on recent threat intelligence.
# Tool/Technique: Greatness PhaaS (Adversary-in-the-Middle & Device Code Phishing)
## Overview
Greatness is a Phishing-as-a-Service (PhaaS) platform that facilitates credential theft and session hijacking targeting enterprise cloud environments, primarily Microsoft 365. It has evolved from simple credential harvesting to sophisticated Adversary-in-the-Middle (AiTM) and Device Code phishing to bypass Multi-Factor Authentication (MFA).
## Technical Details
- **Type:** Phishing-as-a-Service (PhaaS) / Tool
- **Platform:** Microsoft 365, iCloud, Yahoo, Google Workspace
- **Capabilities:** AiTM session hijacking, Device Code phishing, MFA bypass, automated target branding (logo/background spoofing), and post-compromise enumeration via Microsoft Graph API.
- **First Seen:** Mid-2022
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.001 - Phishing: Spearphishing Attachment]
- [T1566.002 - Phishing: Spearphishing Link]
- **[TA0006 - Credential Access]**
- [T1557 - Adversary-in-the-Middle]
- [T1111 - Two-Factor Authentication Evasion]
- [T1528 - Steal Application Access Token]
- **[TA0007 - Discovery]**
- [T1087.003 - Account Discovery: Email Account]
- [T1615 - Group Policy Discovery]
## Functionality
### Core Capabilities
- **AiTM Infrastructure:** Proxies authentication requests between the victim and the legitimate service provider in real-time, allowing attackers to capture session cookies/tokens.
- **Device Code Phishing:** Generates a legitimate Microsoft device code and tricks the victim into authorizing it, granting the attacker access without needing the victim's password.
- **Automated Branding:** Dynamically fetches organization-specific logos and backgrounds based on the victim's email domain to increase the perceived legitimacy of the phishing page.
### Advanced Features
- **Security Filter Bypass:** Abuses whitelisted domains (e.g., RingCentral) to achieve low Spam Confidence Levels (SCL -1) on Microsoft Exchange.
- **Post-Compromise Automation:** Integrated tools for enumerating Outlook, Teams, SharePoint, and OneDrive via Microsoft Graph API once a token is captured.
## Indicators of Compromise
- **File Hashes:** N/A (Web-based infrastructure).
- **File Names:** N/A.
- **Registry Keys:** N/A.
- **Network Indicators:**
- `service@ringcentral[.]com` (Spoofed Sender)
- Traffic originating from IONOS mail servers lacking DKIM.
- Post-compromise logins from VPS/Commercial VPN providers.
- **Behavioral Indicators:**
- MFA-approved sign-ins from unexpected IP ranges (Hosting/VPN).
- Rapid, automated enumeration of Microsoft Graph API endpoints (SharePoint, Teams, OneDrive) immediately following a login.
## Associated Threat Actors
- Distributed to various cybercriminals via a Telegram-based subscription model (approx. $289/month).
- Potentially linked to data sourced from breaches (e.g., RingCentral/ShinyHunters) for targeted lead lists.
## Detection Methods
- **Signature-based:** Detect the specific HTML/JavaScript structures used in Greatness phishing panels.
- **Behavioral:** Monitor for "Impossible Travel" alerts and logins originating from known VPN or VPS exit nodes for M365 accounts.
- **Log Analysis:** Audit Microsoft Entra ID (formerly Azure AD) logs for suspicious Device Code flow requests or unusual MFA-approved sessions.
## Mitigation Strategies
- **Technical Controls:** Audit "Safe-Sender" lists and replace blanket domain whitelisting with strict DMARC/SPF/DKIM enforcement.
- **Hardening:** Implement Phishing-Resistant MFA (e.g., FIDO2 security keys) which are not susceptible to AiTM or Device Code phishing.
- **Incident Response:** If compromise is suspected, administrators should revoke all Refresh Tokens, review OAuth consents, and audit Graph API activity logs.
## Related Tools/Techniques
- **Evilginx2 / Muraena:** Similar AiTM frameworks.
- **Token Replay Attacks:** The underlying technique used to utilize captured session tokens from disparate infrastructures.