Cybercriminals are again upgrading their toolkits. A commercial phishing-as-a-service (PhaaS) platform called Greatness has added device code phishing capabilities, a technique that abuses the legitimate OAuth 2.0 Device Authorization Grant flow. Security researchers say this can help attackers bypass Multi-Factor Authentication (MFA) and gain control by stealing authentication tokens.
Greatness is positioned as an “all-in-one” operator environment. The same infrastructure and operator panel are used for multiple phishing and token-theft methods, reducing the effort needed to run attacks at scale.
What device code phishing enables for attackers
At the core of the new capability is the OAuth Device Authorization Grant flow. In legitimate scenarios, users may authenticate on devices that do not have a full browser UI. The attacker’s goal is to trick victims into completing the flow in a way that results in tokens being issued to the criminal infrastructure.
Unlike phishing patterns that rely on a fake login page, device code phishing can feel “clean” to the user because the password entry happens on the real identity provider. The user is typically asked for a short code and a reason to enter it—details that may not appear suspicious to the victim.
How Greatness expands its phishing ecosystem
According to reporting shared with The Hacker News, Greatness already supported multiple advanced theft techniques, including AiTM (adversary-in-the-middle) credential and token theft and OAuth consent abuse. The newest addition is a device code phishing branch that attackers can use to silently obtain tokens without requiring direct, interactive user behavior beyond completing the flow.
In the same operator environment, the platform has also been described as expanding to multiple target platforms, including services associated with iCloud, Yahoo, and Google Workspace. This matters because it signals that the operators are not limited to a single ecosystem or identity flow.
Access and subscription model
Greatness is described as being sold through a subscription using a public-facing Telegram channel (with a subscriber base that has grown into the thousands). The subscription price is reported to have increased over time—from a previously reported lower monthly amount to a higher current figure.
After subscribing, customers receive access to an operator panel. That dashboard is described as providing campaign statistics and configuration options such as domain settings and CAPTCHA selection. It also includes a library of ready-to-use lure templates, including materials intended to mimic voicemail, document sharing, and QR-code-driven interactions.
Ready-to-run lures and multi-stage delivery
The platform’s lure templates are packaged so operators do not need to build them from scratch. Reported template examples include variants tied to audio login experiences, chat assistance, Windows explorer-themed pages, voicemail, OneDrive-themed content, QR flows, and video-player themed lures.
When victims interact with a link in a phishing email, the journey is handled by a multi-stage redirect chain. Researchers describe measures such as anti-analysis protections, user-agent fingerprinting, and CAPTCHA gates. Only after these checks does the victim reach the final destination, which can route into either AiTM-style infrastructure or the device code endpoint used for OAuth token capture.
Why token theft can keep working after the initial lure
After compromise, the attackers’ objective is not only to capture a token, but to reuse it effectively. Reporting indicates that harvested authentication tokens are replayed quickly—within minutes—using dedicated proxy infrastructure.
Once the tokens are accepted, attackers can enumerate and access various Microsoft 365 resources via the Microsoft Graph API, including commonly used collaboration and productivity areas such as Outlook, Teams, SharePoint, Exchange, OneDrive, contacts, and calendars. In short, the value is in the breadth of reachable data and the ability to act across multiple service components.
There are also observations suggesting that attacker infrastructure can remain active for extended periods. In one described case, an AiTM proxy IP was seen authenticating against a victim account more than two weeks after the initial phishing campaign, indicating that token validity and replay opportunities may extend beyond the first incident.
Persistence tactics: new devices and delayed actions
Device code phishing and token theft do not only enable immediate access. Reporting also describes post-compromise behaviors intended to improve persistence, such as registering new devices to obtain tokens suitable for long-term continued access.
Timing can be part of the tradecraft. In one set of observations, malicious inbox rules or sensitive data actions were delayed for several hours to reduce the chance of triggering fast detection and to avoid standing out right away.
Leveraging trusted relationships through spoofed communications
Another detail highlighted in the reporting is the way phishing lures are tailored to exploit existing trust. Some campaigns reportedly used voicemail-themed messages that spoof a communications provider, aiming to pass through email gateway defenses by taking advantage of safe-sender exclusions.
Importantly, the emails are described as not merely impersonating a vendor. Instead, they exploit trust configuration that exists because the target organization is an actual customer. Researchers note that if a vendor breach exposes a customer list, it can also reveal which organizations are likely to have the vendor’s domain on allowlists—creating a pathway for more effective delivery.
From a defender’s perspective, vendor breach disclosures therefore become operational signals: they should prompt auditing and tightening of email exclusion rules for affected vendor domains.
Broader trend: PhaaS platforms moving toward OAuth abuse
The appearance of device code phishing in Greatness fits a wider pattern. In recent months, multiple PhaaS ecosystems have increasingly blended well-known “tool tradecraft” with OAuth flows. Even when law enforcement actions disrupted infrastructure tied to similar services, researchers note that device-code phishing pages and redirect patterns can still use CAPTCHAs, multi-hop redirect chains, and other anti-analysis measures to reduce the effectiveness of automated analysis.
How to reduce the risk of device code phishing
No single control is sufficient on its own, but there are several practical approaches recommended in the reporting:
- Block the authentication method at a global level using Conditional Access Policies. This directly targets the OAuth flow that attackers abuse for device code phishing.
- Move to phishing-resistant MFA methods where possible. The goal is to prevent token capture from being usable for account takeover even if users interact with fraudulent prompts.
- Teach employees to distrust unexpected codes and treat short codes requested out of context as a potential fraud indicator.
- Use explicit exclusions only when necessary. If a device-code flow is required for specific use cases, those users and resources should be narrowly scoped and continuously audited, with access revoked as soon as it is no longer required.
By combining Conditional Access restrictions with safer authentication methods and better user awareness, organizations can reduce both the success rate and the impact of device code phishing attempts.
Conclusion
The Greatness PhaaS update shows how quickly phishing ecosystems evolve. By adding device code phishing support, the platform can exploit OAuth Device Authorization Grant to bypass MFA and steal tokens, then leverage those tokens for broad Microsoft 365 access. For defenders, the message is clear: review Conditional Access settings, tighten authentication controls, and ensure that unexpected codes are treated as a security event rather than a normal workflow.
Source: https://thehackernews.com/2026/08/greatness-phaas-adds-device-code.html
