Trustwave Unveils New Offerings to Maximize Value of Microsoft Security Investments. Learn More

Trustwave Unveils New Offerings to Maximize Value of Microsoft Security Investments. Learn More

Services
Capture
Managed Detection & Response

Eliminate active threats with 24/7 threat detection, investigation, and response.

twi-managed-portal-color
Co-Managed SOC (SIEM)

Maximize your SIEM investment, stop alert fatigue, and enhance your team with hybrid security operations support.

twi-briefcase-color-svg
Advisory & Diagnostics

Advance your cybersecurity program and get expert guidance where you need it most.

tw-laptop-data
Penetration Testing

Test your physical locations and IT infrastructure to shore up weaknesses before exploitation.

twi-database-color-svg
Database Security

Prevent unauthorized access and exceed compliance requirements.

twi-email-color-svg
Email Security

Stop email threats others miss and secure your organization against the #1 ransomware attack vector.

tw-officer
Digital Forensics & Incident Response

Prepare for the inevitable with 24/7 global breach response in-region and available on-site.

tw-network
Firewall & Technology Management

Mitigate risk of a cyberattack with 24/7 incident and health monitoring and the latest threat intelligence.

Solutions
BY TOPIC
Offensive Security
Solutions to maximize your security ROI
Microsoft Exchange Server Attacks
Stay protected against emerging threats
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
About Us
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Security Operations Platform
Trustwave Security Colony
Partners
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats
SpiderLabs Blog

Trustwave SpiderLabs Detects Spike in Greatness Phishing Kit Attacks on Microsoft 365 Users

Trustwave SpiderLabs is tracking a spike in usage of the Greatness phishing kit to attack Microsoft 365 users to distribute malicious HTML attachments that steal login credentials.

Greatness is a phishing-as-a-service platform developed by a threat actor known as "fisherstell," and has been available since mid-2022 that provides a ready-made infrastructure and tools for anyone to launch phishing campaigns charging $120 per month in Bitcoin. The kit provides a ready-made infrastructure and tools for anyone to launch phishing campaigns.

Trustwave SpiderLabs notes the increase in activity ran from December 2023 into January 2024.

The number of victims is unknown at this time, but Greatness is widely used and well-supported, with its own Telegram community providing information on how to operate the kit, along with additional tips and tricks. The Greatness kit being used during this recent surge in attacks represents the latest HTML phishing iteration we've observed deployed.

Trustwave MailMarshal protects clients against phishing emails generated with the Greatness phishing kit.

 

Why the Greatness Kit is Great

The kit is regularly updated, so it constantly evolves to bypass defenses, making it a persistent threat. The developers released the latest update in early January 2024, and they posted documentation on the Greatness Hub's Telegram detailing key features, tips, and tricks.

 

Phishing_Kit_Pic1

Figure 1. Greatness phishing kit documentation

 

These key features include:

  • Customizable email elements: The kit allows for personalizing sender names, email addresses, subjects, messages, attachments, and QR codes, enhancing relevance and engagement.
  • Anti-detection measures: Features like randomizing headers, encoding, and obfuscation aim to bypass spam filters and detection systems.

 

 How Greatness Operates

 

Phishing_Kit_Pic2

Figure 2. Subscriptions and pricing of Greatness kit

 

Access to the Greatness platform is facilitated through a subscription available on its Telegram channel. Interested individuals, including aspiring cybercriminals, can obtain a subscription starting from $120 per month. Phishing-as-a-service platforms lower the barrier of entry for cybercrime.

Initially, attackers create phishing campaigns within the platform. The platform then generates deceptive phishing emails or attachments, often resembling legitimate documents from reputable sources like Microsoft. When victims interact with these phishing documents, such as clicking on links or opening attachments, it allows Greatness to capture their login credentials.

Notably, the platform goes beyond simple credential theft. It can bypass Multi-Factor Authentication (MFA) by prompting victims for the codes sent to their phones or emails. This additional layer of security is exploited to ensure a more comprehensive compromise of the victim's accounts. The stolen credentials are subsequently sent to the attacker via Telegram, completing the phishing attack.

The HTML attachment code hides encoded data attributes, including the phishing URL, within a random HTML element. The HTML attachments are varied and include PDF, Excel, Word, archives, and executables, and it also supports QR code generation to store phishing links.

The kit utilizes the 'classList' property to access hidden attributes; then, it decodes the data using 'tab' before appending the phishing code to the HTML body.

The kit targets organizations that use Microsoft 365, is designed to steal login credentials, and provides options for obfuscating the HTML file, making it a common attachment choice as success rates might be higher.

 

Social Engineering and Pressure Tactics

A noticeable feature of phishing emails generated by the Greatness kit, and really of all successful phishing malware, is generating a false sense of urgency and including enough information to convince the recipient to open the attachment without carefully assessing the risk.

In the cases Trustwave SpiderLabs spotted, the emails include phrases to scare the target into opening the email and attachment by creating a sense of urgency with subjects like "urgent invoice payments" or "urgent account verification required."

 

Phishing_Kit_Pic3

Figure 3. A phishing variant using HTML attachment

 

Supporting these urgent requests are phrases designed to pique the target's curiosity and make them open the attachment to see what it contains. Examples include "confidential employee list" or "secret bonus offer."

The phishing emails generated by Greatness go a step further by spoofing legitimate senders and file formats, further building their case that the email is real and must be opened. The attachment may appear to come from a trusted source, like a bank or employer, and use familiar file formats like invoices, tax documents or employee benefits. This sourcing information increases the perceived legitimacy and lowers suspicion.

 

Phishing_Kit_Pic4

Figure 4. A 401K plan themed phish variant using QR code

 

Once the social engineering and supporting materials have done their job and the target opens the email, one of two events will take place. Opening the attachment might direct the victim to a fake website that resembles a legitimate login page, tricking them into entering their credentials. Alternatively, the attachment might contain malware that installs itself on the victim's device, giving the attacker access to their information.

Latest SpiderLabs Blogs

Search & Spoof: Abuse of Windows Search to Redirect to Malware

Trustwave SpiderLabs has detected a sophisticated malware campaign that leverages the Windows search functionality embedded in HTML code to deploy malware. We found the threat actors utilizing a...

Read More

The Sentinel’s Watch: Building a Security Reporting Framework

Imagine being on shift as the guard of a fortress. Your job is to identify threats as they approach the perimeter. The more methods you have for detecting those threats, the better your chances of...

Read More

Fake Advanced IP Scanner Installer Delivers Dangerous CobaltStrike Backdoor

During a recent client investigation, Trustwave SpiderLabs found a malicious version of the Advanced IP Scanner installer, which contained a backdoored DLL module. Our client had been searching for...

Read More