Why are there so many malware-as-a-service offerings?
Summary: Cisco Talos writes that threat actors have used the as-a-service business model for over a decade, originally called commodity malware, selling toolkits on illicit sites for monthly fees or charging creators to distribute malware and manage infections. Talos researchers found Greatness, a phishing-as-a-service tool in use since mid-2022 that targets Microsoft 365 login pages and offers MFA bypass, IP filtering, and Telegram bot integration to affiliates who only need an API key to deploy it.
Why it matters: Greatness pre-fills the victim's email address and pulls the real company logo and background from the target's Microsoft 365 login page, so anyone with moderate technical ability can run convincing phishing against your business users. Talos notes that push-notification MFA is the easier method to break and recommends code-based authentication instead.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026