Greatness PhaaS Adds Device Code Phishing to Bypass MFA and Steal Tokens
Summary: The commercial phishing-as-a-service toolkit Greatness has added device code phishing, abusing the OAuth 2.0 Device Authorization Grant to bypass MFA and obtain tokens without user interaction, alongside its existing adversary-in-the-middle credential and token theft and OAuth consent abuse. Access starts at $289 per month, up from $120 in January 2024, sold through a Telegram channel with more than 3,250 subscribers and a dashboard offering campaign statistics, domain configuration, CAPTCHA selection, and more than 11 downloadable lure templates.
Key Takeaway: ZeroBEC observed one AiTM proxy IP authenticating against a victim's Microsoft 365 account more than two weeks after the initial campaign, and attackers have registered new devices within minutes to generate a Primary Refresh Token for long-term persistence - so a single successful phish can mean weeks of access rather than a single session.
Read the original at The Hacker News ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026