Greatness, for now, is only focused on Microsoft 365 phishing pages, providing its affiliates with an attachment and link builder that creates highly convincing decoy and login pages.
It contains features such as having the victim’s email address pre-filled and displaying their appropriate company logo and background image extracted from the target organization’s actual Microsoft 365 login page.
Campaigns involving Greatness have mainly manufacturing, health care, and technology entities located in the U.S., the U.K., Australia, South Africa, and Canada, with a spike in activity detected in December 2022 and March 2023.
Phishing kits like Greatness offer threat actors, rookies, or otherwise, a cost-effective and scalable one-stop shop, making it possible to design convincing login pages associated with various online services and bypass two-factor authentication (2FA) protections.
Specifically, the authentic-looking decoy pages function as a reverse proxy to harvest credentials and time-based one-time passwords (TOTPs) entered by the victims.
The entered credentials and tokens are subsequently forwarded to the affiliate’s Telegram channel for obtaining unauthorized access to the accounts in question.
The AiTM phishing kit also has an administration panel that enables the affiliate to configure the Telegram bot, keep track of stolen information, and even build booby-trapped attachments or links.
Moreover, each affiliate must have a valid API key to load the phishing page. The API key also prevents unwanted IP addresses from viewing the phishing page and facilitates behind-the-scenes communication with the actual Microsoft 365 login page by posing as the victim.
Working together, the phishing kit and the API perform a ‘man-in-the-middle’ attack, requesting information from the victim that the API will submit to the legitimate login page in real-time.
This allows the PaaS affiliate to steal usernames, passwords, and authenticated session cookies if the victim uses MFA.
The findings come as Microsoft has begun enforcing number matching in Microsoft Authenticator push notifications as of May 8, 2023, to improve 2FA protections and fend off prompt bombing attacks.