Cybercriminals are increasingly weaponising trusted enterprise communications software to breach corporate networks, with a sophisticated phishing-as-a-service campaign now impersonating cloud phone giant RingCentral to compromise Microsoft 365 accounts. The attack vector exploits the deep trust enterprise employees place in routine office tools, tricking recipients into surrendering critical authentication tokens and login credentials. Security researchers identified the campaign leveraging adversary-in-the-middle phishing kits to seamlessly intercept corporate multi-factor authentication defenses.
The campaign begins when victims receive seemingly authentic email notifications, often mimicking RingCentral missed call alerts, voicemail notifications, or urgent business contracts. These messages originate either from compromised business accounts or spoofed infrastructure carefully designed to pass basic email validation checks. Once a user clicks the embedded link, they are directed through multiple redirection stages, including automated CAPTCHA challenges, designed specifically to evade security scanners and sandbox detection mechanisms.
Abuse of OAuth Consent and AiTM Redirection
What renders this operation particularly dangerous is its dual-pronged technical architecture, which combines rogue Microsoft 365 OAuth applications with advanced adversary-in-the-middle infrastructure. In many instances, victims are presented with a legitimate-looking Microsoft consent prompt requesting permissions for a fake enterprise application spoofing RingCentral or related corporate services. By requesting seemingly benign basic permissions such as user profile read access and openid authentication, the malicious application avoids triggering standard security flags while granting the attacker a persistent foothold within the victim’s tenant.
Simultaneously, the threat actors utilise the Tycoon phishing-as-a-service framework to operate a reverse proxy between the target user and the authentic Microsoft authentication server. When the victim enters their credentials and completes multi-factor authentication, the reverse proxy intercepts the active session cookies and OAuth access tokens in real time. This allows attackers to bypass two-factor security mechanisms completely without needing to crack complex passwords or repeatedly prompt the victim for additional authentication codes.
Immediate Enterprise Risk and Defense Strategies
Once an account is compromised, the threat actors move swiftly to establish persistence and exploit the breached enterprise ecosystem. Having secured valid session tokens, attackers gain unhindered access to corporate inboxes, internal communications in Microsoft Teams, and sensitive documents stored across SharePoint and OneDrive. Security analysts note that compromised accounts are routinely deployed as launching pads for internal spear-phishing campaigns, vendor email compromise schemes, and financial fraud targeting partner organisations globally.
Mitigating this evolving threat requires enterprise security teams to move beyond traditional email filtering and employee awareness training. Security administrators must tighten tenant configuration policies by restricting end-user consent for third-party OAuth applications, enforcing strict admin consent workflows, and deploying conditional access rules based on device compliance and geographic anomalies. As cybercriminals continue to turn trusted enterprise tools into Trojan horses, organisations must treat every external authentication request with rigorous cryptographic scrutiny.
