Greatness PhaaS Adds Device Code Phishing to Bypass MFA and Steal Tokens

The commercialization of cybercrime has reached a new level of sophistication with the latest update to the 'Greatness' Phishing-as-a-Service (PhaaS) toolkit. By integrating device code phishing capabilities, this kit allows even low-skilled threat actors to bypass modern Multi-Factor Authentication (MFA) protocols. This development signifies a pivot in the adversarial landscape, moving beyond simple credential harvesting toward the exploitation of legitimate authentication flows, specifically targeting the OAuth 2.0 Device Authorization Grant.

The emergence of Greatness as a dominant player in the PhaaS market follows a historical trend of 'crimeware' mirroring legitimate SaaS business models. Traditionally, phishing relied on fraudulent login pages to steal passwords. However, as organizations adopted MFA—often touted as the gold standard of defense—attackers responded with Adversary-in-the-Middle (AiTM) techniques. Greatness has historically been a leader in this space, providing subscribers with an easy-to-use interface, automated bypasses for Microsoft 365, and sophisticated evasion techniques that prevent security scanners from detecting its infrastructure.

The mechanics of this new threat involve a clever manipulation of the OAuth 2.0 protocol. In a standard device code flow, a user attempting to log into a resource-constrained device (like a smart TV or a CLI tool) is given a short alphanumeric code and directed to a verification URL on a separate, trusted device. The Greatness toolkit automates the delivery of these codes to victims via email or malicious websites. When a user enters the code and authenticates on their own device, they are unknowingly granting an access token directly to the attacker. Because this occurs on a legitimate Microsoft or Google domain, it circumvents many traditional phishing filters and eliminates the need for the attacker to host a fake login page.

The shift toward token theft via device code grants represents a fundamental challenge to the current security paradigm. By obtaining a session token rather than a password, attackers can maintain persistent access to an environment without needing to re-authenticate or trigger MFA prompts. This method is particularly effective because it leverages the inherent trust users have in 'official' authentication prompts. Furthermore, since the authentication happens on a legitimate service’s URL, traditional indicators of a phishing attack—such as a misspelled domain name—are entirely absent, making detection nearly impossible for the average employee.

From a market perspective, the inclusion of these features in a 'as-a-service' model democratizes high-level corporate espionage. Previously, such sophisticated bypasses were the domain of state-sponsored actors or advanced persistent threat (APT) groups. Now, any criminal with a modest subscription fee can launch campaigns that neutralize an enterprise’s primary defense layer. This creates a supply-side pressure on the cybersecurity industry, forcing a move toward more granular conditional access policies and the phasing out of phishing-prone MFA methods in favor of hardware-backed solutions like FIDO2 security keys.

As we look toward the future, the primary concern is the scalability of these attacks. We should expect to see a surge in 'token-based' intrusions where the initial entry point is not a vulnerability in software, but a vulnerability in the human-led authentication process. Organizations must watch for anomalies in OAuth token requests and consider disabling the device code flow entirely if it is not business-critical. The evolution of Greatness proves that as long as there is a gap between technical protocols and human behavior, crimeware developers will find a way to monetize it.