Most businesses eventually add a supplier to a “safe senders” or allow list so their emails stop landing in junk. It sounds like a sensible fix for a real annoyance. A campaign reported this month shows how that one shortcut can quietly undo the rest of your email security.
What happened
Email security firm ZeroBEC documented attackers using a phishing-as-a-service platform called Greatness, rented out for around US$289 a month, which targets Microsoft 365, Google Workspace, iCloud and Yahoo accounts. The emails were made to look like they came from service@ringcentral.com, a well known business phone and communications provider.
Those emails failed the standard checks meant to catch forgeries, SPF and DMARC. They were delivered anyway, because the receiving organisations had whitelisted RingCentral’s domain outright. The allow list overrode the warning. The lures were ordinary office business: a missed voicemail, a performance review to read. Some carried a fake verification banner to look more convincing.
Why multi-factor did not stop it
This attack does not try to guess a password. The victim is steered to a page sitting between them and the real Microsoft login, so they type their password, approve the multi-factor prompt as normal, and everything appears to work. What the attacker collects is the signed-in session token that comes out the other side, already approved by MFA. Those sessions were then reused from hosting and VPN addresses. A second version of the attack abuses Microsoft’s device sign-in flow, where the victim is talked into entering a short code.
What to check this week
- Review your safe sender and allow lists. A blanket exemption for an entire domain is the weak point. Remove it and let proper email authentication do its job.
- Ask whoever manages your Microsoft 365 to look for successful sign-ins arriving from hosting providers or VPN addresses.
- If you think an account has been caught, a password reset alone is not enough. Active sessions have to be revoked and app permissions reviewed.
- Remind staff that a login page appearing after an email is a moment to slow down, not to hurry.
Worried this affects your business? Get a free 15-minute IT check – call Trends IT on 0485 011 911 or visit /contact/.