Multi-factor authentication is supposed to be the safety net that catches a stolen password before it becomes an account takeover. A phishing-as-a-service operation called Greatness is built specifically to cut that net. Instead of just harvesting a username and password, it intercepts the live authentication token issued after a victim completes their normal MFA prompt, handing the attacker a working session as though they were the legitimate user.

A Voicemail Lure That Slipped Past Its Own Defenses

Analysts at ZeroBEC uncovered the activity while examining four suspicious emails sent to a protected organization. The messages impersonated RingCentral voicemail notifications and internal performance-review reminders, both classic pretexts designed to create a quick, low-friction click. Notably, the emails failed SPF, DKIM, and DMARC authentication checks outright, the exact signals email security tools are built to catch. They got through anyway, because a domain-based safe-sender exclusion on the receiving end overrode the failed checks. A setting meant to reduce false positives for a trusted vendor instead became the open door.

How the Relay Actually Works

Greatness began life as a more conventional phishing kit but has since matured into a full service, complete with ready-made lure templates, configurable attacker-controlled domains, and support for targeting Microsoft 365, Google Workspace, iCloud, and Yahoo accounts. Operators manage campaigns through a centralized panel advertised on Telegram.

The technical core is an adversary-in-the-middle relay. When a victim clicks through, they land on a page that mirrors their organization’s real branding, complete with a working login form. The victim enters their password and completes the actual MFA challenge exactly as they normally would, because they are, in effect, logging into the genuine Microsoft 365 service through a relay sitting in the middle. The attacker never needs to defeat MFA directly, they simply capture the authentication token issued at the end of that legitimate exchange.

Greatness also offers a secondary path via device-code phishing, where document-themed lure pages talk victims into entering a code that approves a real sign-in on the attacker’s behalf. Both routes bypass the assumption that MFA alone is sufficient protection. The kit also screens visitors for automated browsers and inserts a human-verification step, making it harder for routine security scanning to flag the page before a human ever sees it.

Why a Password Reset Isn’t Enough

The stolen token doesn’t just unlock a mailbox. It can expose Outlook, Teams, SharePoint, OneDrive, calendars, contacts, and any applications registered to that identity, creating a launchpad for further fraud or internal phishing across the rest of the organization. This is also why standard incident response playbooks fall short here: resetting a password does nothing to invalidate a token or refresh token that is already in an attacker’s hands. Effective remediation means revoking active sessions in Entra ID, auditing OAuth application consent grants, and hunting for sign-ins that already cleared MFA from unfamiliar networks or devices.

Closing the Configuration Gap

The campaign is a reminder that email security can fail through misconfiguration just as easily as through a missing product. Security teams should review every safe-sender list and transport-rule exclusion, particularly ones granted to common software and communication vendors, and require that exempted domains still pass authentication checks on their mail. A vendor’s own breach notice should be treated as a trigger to revisit these exclusions, since attackers can mine customer lists to figure out which companies are primed to trust a given vendor domain.

Detection should also focus on mismatches between the claimed sender brand, the actual sending domain, and the final landing page, along with unusual Laravel session cookies and rapid access to multiple Microsoft 365 services from a single new network shortly after a login. Because Greatness’s infrastructure rotates domains and proxy nodes quickly, defenders are better served by watching for these behavioral patterns than by relying solely on static domain blocklists.