Trustwave SpiderLabs is tracking a spike in usage of the Greatness phishing kit to attack Microsoft 365 users to distribute malicious HTML attachments that steal login credentials.
Greatness is a phishing-as-a-service platform developed by a threat actor known as "fisherstell," and has been available since mid-2022 that provides a ready-made infrastructure and tools for anyone to launch phishing campaigns charging $120 per month in Bitcoin. The kit provides a ready-made infrastructure and tools for anyone to launch phishing campaigns.
Trustwave SpiderLabs notes the increase in activity ran from December 2023 into January 2024.
The number of victims is unknown at this time, but Greatness is widely used and well-supported, with its own Telegram community providing information on how to operate the kit, along with additional tips and tricks. The Greatness kit being used during this recent surge in attacks represents the latest HTML phishing iteration we've observed deployed.
Trustwave MailMarshal protects clients against phishing emails generated with the Greatness phishing kit.
The kit is regularly updated, so it constantly evolves to bypass defenses, making it a persistent threat. The developers released the latest update in early January 2024, and they posted documentation on the Greatness Hub's Telegram detailing key features, tips, and tricks.
Figure 1. Greatness phishing kit documentation
These key features include:
Figure 2. Subscriptions and pricing of Greatness kit
Access to the Greatness platform is facilitated through a subscription available on its Telegram channel. Interested individuals, including aspiring cybercriminals, can obtain a subscription starting from $120 per month. Phishing-as-a-service platforms lower the barrier of entry for cybercrime.
Initially, attackers create phishing campaigns within the platform. The platform then generates deceptive phishing emails or attachments, often resembling legitimate documents from reputable sources like Microsoft. When victims interact with these phishing documents, such as clicking on links or opening attachments, it allows Greatness to capture their login credentials.
Notably, the platform goes beyond simple credential theft. It can bypass Multi-Factor Authentication (MFA) by prompting victims for the codes sent to their phones or emails. This additional layer of security is exploited to ensure a more comprehensive compromise of the victim's accounts. The stolen credentials are subsequently sent to the attacker via Telegram, completing the phishing attack.
The HTML attachment code hides encoded data attributes, including the phishing URL, within a random HTML element. The HTML attachments are varied and include PDF, Excel, Word, archives, and executables, and it also supports QR code generation to store phishing links.
The kit utilizes the 'classList' property to access hidden attributes; then, it decodes the data using 'tab' before appending the phishing code to the HTML body.
The kit targets organizations that use Microsoft 365, is designed to steal login credentials, and provides options for obfuscating the HTML file, making it a common attachment choice as success rates might be higher.
A noticeable feature of phishing emails generated by the Greatness kit, and really of all successful phishing malware, is generating a false sense of urgency and including enough information to convince the recipient to open the attachment without carefully assessing the risk.
In the cases Trustwave SpiderLabs spotted, the emails include phrases to scare the target into opening the email and attachment by creating a sense of urgency with subjects like "urgent invoice payments" or "urgent account verification required."
Figure 3. A phishing variant using HTML attachment
Supporting these urgent requests are phrases designed to pique the target's curiosity and make them open the attachment to see what it contains. Examples include "confidential employee list" or "secret bonus offer."
The phishing emails generated by Greatness go a step further by spoofing legitimate senders and file formats, further building their case that the email is real and must be opened. The attachment may appear to come from a trusted source, like a bank or employer, and use familiar file formats like invoices, tax documents or employee benefits. This sourcing information increases the perceived legitimacy and lowers suspicion.
Figure 4. A 401K plan themed phish variant using QR code
Once the social engineering and supporting materials have done their job and the target opens the email, one of two events will take place. Opening the attachment might direct the victim to a fake website that resembles a legitimate login page, tricking them into entering their credentials. Alternatively, the attachment might contain malware that installs itself on the victim's device, giving the attacker access to their information.