Phishing Kits Are Spoofing Trusted Vendors to Break Into Microsoft 365

A phishing-as-a-service platform called Greatness has found a tidy way past your email filters: it pretends to be a business vendor you already trust. In a campaign reported this week by BleepingComputer, attackers sent fake voicemail and performance-review emails claiming to come from the cloud-phone provider RingCentral. The messages failed every technical check — no valid SPF, DMARC or DKIM — yet still landed in inboxes, because RingCentral was sitting on the recipient’s safe-sender allowlist. One click led to a convincing Microsoft 365 login page that quietly captured the victim’s password and their MFA-approved session token.

Here’s why this matters for Australian businesses specifically. Greatness has been targeting Microsoft 365 users in Australia — alongside the US, UK, Canada and South Africa — for years, and it now rents for about US$289 a month to anyone on a Telegram channel. This isn’t elite hacking; it’s a subscription. And the weak point it exploited isn’t your spam filter. It’s the safe-sender list. In most small businesses we look at, that list is a graveyard of domains someone allowlisted years ago to stop a supplier’s invoices bouncing to junk, then never reviewed again. Every stale entry is a lane you’ve told the filter to wave straight through.

Three things worth doing this week. First, audit your safe-sender and allowlist rules and replace blanket domain exclusions with rules that still demand valid email authentication. Second, accept that ordinary MFA no longer stops this — the token theft happens after you approve the prompt — so move toward phishing-resistant sign-in like passkeys. Third, treat any surprise “voicemail” or “review” notification from a vendor as suspect, and go to the service directly instead of clicking the button.

This is exactly the kind of gap we close for clients: hardening Microsoft 365 sign-in, cleaning up mail-flow and allowlist rules, and running staff cyber safety training so your team spots the lure before it costs you a mailbox. If your allowlist hasn’t been looked at in the past year, that’s the place to start.