Greatness PhaaS Adds Device Code Phishing to Bypass MFA and Hijack Accounts

The commercial Phishing-as-a-Service (PhaaS) platform known as Greatness has expanded its capability suite to include device code phishing, allowing cybercriminals to bypass Multi-Factor Authentication (MFA) and harvest session tokens across major cloud platforms. By integrating support for abusing the legitimate OAuth 2.0 Device Authorization Grant alongside its existing Adversary-in-the-Middle (AiTM) capabilities, Greatness provides subscribers with a unified ecosystem for account takeover targeting Microsoft 365, Google Workspace, iCloud, and Yahoo business accounts.

How Device Code Phishing Bypasses MFA

Device code phishing represents a structural shift away from traditional credential harvesting or inline AiTM proxies. Originally specified in RFC 8628, the OAuth 2.0 Device Authorization Grant flow was designed for input-constrained devices—such as smart TVs, printers, or IoT hardware—that lack a full web browser for interactive login. In this protocol, an application requests an authorization code from an identity provider, generating a short alphanumeric user code alongside a verification URL (such as microsoft.com/devicelogin).

When weaponized by threat actors, the attacker initiates a device authorization flow programmatically and presents the target victim with the legitimate identity provider’s verification URL along with the generated user code. Because the victim navigates to and authenticates on the actual, official authentication portal of their service provider, no malicious proxy site is exposed, and security gateways see no spoofed login pages. The victim completes their standard authentication process—including submitting their password and satisfying any required MFA prompts—under the belief that they are authorizing a routine service connection. Once the user enters the code and completes login, the identity provider issues OAuth access tokens and refresh tokens directly to the attacker’s client application, handing over full access to the victim’s account without requiring the attacker to handle credentials directly.

Greatness PhaaS: Pricing, Infrastructure, and Capabilities

First documented by security researchers in May 2023 and active against Microsoft 365 targets since at least mid-2022, Greatness operates as a turnkey crimeware-as-a-service model designed to lower the barrier to entry for lower-skilled threat actors. Operations are coordinated via a public Telegram channel (@GreatnessPage) with over 3,250 subscribers. Subscription pricing has escalated alongside platform development, now starting at $289 per month—up from $120 per month reported in early 2024.

License provisioning, operator registration, and ongoing support are managed through a dedicated Telegram bot (@gr8managerbot) and developer handles (@greatnessmgr). Operators log into their customized management panels using a User ID and a 9-character license key, which provisions an operator-specific domain formatted as api-[token].[base-domain].

The administration dashboard provides campaign statistics, victim heat maps, link configuration options, CAPTCHA selection, and over 11 pre-packaged phishing lure templates. Downloadable lures include ZIP archives containing pre-built HTML, PDF redirectors, and SVG files designed to impersonate:

• OneDrive and document sharing prompts
• AudioLogin and Voicemail alerts
• Windows Explorer interfaces
• ChatAssistance and VideoPlayer pages
• QR code lures

To secure captured logs and session cookies, the platform implements a one-way hashing system where stolen data can only be decrypted and extracted by subscribers using their own Telegram account 2FA code.

Attack Delivery and Abuse of Safe-Sender Exclusions

Recent campaigns leveraging Greatness demonstrate sophisticated delivery mechanics designed to bypass email security controls. Victims encounter booby-trapped links delivered via spoofed RingCentral voicemail notifications. These phishing emails are specifically tailored to target organizations that are legitimate RingCentral customers.

Because many organizations add their core SaaS vendors to internal “safe sender” lists or create explicit exclusion rules in their secure email gateways (SEGs), these phishing lures frequently reach victim inboxes despite failing SPF, DKIM, and DMARC verification checks. The trust configuration itself is exploited: when a third-party vendor suffers a breach exposing its customer lists, threat actors use that list to craft hyper-personalized lures targeting organizations known to have safe-sender exemptions configured for that vendor domain.

When a target clicks the phishing link, they traverse a five-stage redirect chain that executes anti-analysis checks, User-Agent fingerprinting, and a CAPTCHA gate before routing the connection to either an AiTM proxy server or a device code authorization endpoint.

Post-Compromise Activity and Persistent Access

Analysis of post-compromise telemetry reveals that harvested authentication tokens are replayed within minutes using dedicated proxy infrastructure. Attackers immediately leverage the Microsoft Graph API to enumerate internal organizational resources, probing Outlook mailboxes, Teams channels, SharePoint repositories, Exchange configurations, OneDrive files, contact lists, and registered enterprise applications.

Threat actors maintain persistent access through several techniques:

• Extended Token Validity: Active authentication sessions have been observed replaying captured tokens over two weeks after initial compromise (including traffic from proxy IP 38.248.95[.]214).
• Device Registration and PRTs: Within minutes of gaining initial access, attackers register new rogue devices to generate Primary Refresh Tokens (PRTs), allowing long-term persistence even if session cookies expire.
• Delayed Exfiltration: Attackers frequently wait several hours after initial access before establishing inbox forwarding rules or exfiltrating email data to evade immediate detection by automated behavioral monitoring tools.

Recommended Mitigations

Standard MFA implementations relying on basic push notifications or TOTP do not inherently block device code phishing, as the user completes the MFA prompt on the legitimate provider site.

To mitigate Greatness PhaaS and device code attacks, organizations should implement the following targeted controls:

1. Restrict OAuth Device Code Authorization: Disable or restrict the OAuth 2.0 Device Code flow across tenant environments (e.g., via Microsoft Entra ID Conditional Access policies) for all users who do not require input-constrained device logins.
2. Audit Safe Sender Lists: Review and eliminate blanket domain-based safe-sender rules or SEG exemptions for third-party vendors (such as RingCentral). Require strict SPF/DKIM/DMARC alignment regardless of sender domain reputation.
3. Enforce Strict Device Compliance: Require managed, compliant devices (via Microsoft Intune or equivalent MDM) to access cloud resources, blocking unmanaged rogue devices from registering or generating PRTs.
4. Active Token Revocation and IP Hunting: In the event of suspected compromise, invalidate all refresh tokens, revoke active sessions via Graph API, unregister unrecognized devices, and block known proxy IPs including 38.248.95[.]214.