New phishing-as-a-service tool “Greatness” already seen in the wild
Summary: Cisco Talos reports that a phishing-as-a-service tool called Greatness began operating in mid-2022, with activity spikes in December 2022 and March 2023, and that over 50 percent of targets were based in the U.S., followed by the U.K., Australia, South Africa and Canada. The service targets Microsoft 365 business users almost exclusively, using HTML attachments that run obfuscated JavaScript to load a phishing page, then acting as a man-in-the-middle to relay credentials and MFA prompts to the real Microsoft 365 login and collect authenticated session cookies for delivery to affiliates via Telegram or a web panel.
What's compelling: Manufacturing was the most-targeted sector, followed by health care, technology and real estate, and because the service captures authenticated session cookies after MFA, a stolen password alone is not the exposure - a completed MFA prompt can hand an affiliate a live session.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026